S03B1021

Users
Manual
Safety Control
Station Reference
IM 32S03B10-21E
IM 32S03B10-21E
3rd Edition

Introduction
Safety Control Station (SCS) is a station for safety control. The SCS monitors the plant safety
status, and carries out safety controls according to various safety demands.
Provided as a reference to be checked for the necessary information when needed, this
document explains the SCS configuration, safety control, the functions and function blocks that
comprise the application logics for safety control, and the external communication function of
the SCS, such as the integration structure with CENTUM VP or CENTUM CS 3000 (hereinafter
referred to as CENTUM). The SCS engineering or maintenance personnel should well
understand the contents of this document.
Structure of this document is as follows:
Part A SCS Common

This part contains a functional overview of the SCS as well as an overview on software/
hardware configurations, process data I/Os and setting items, the inter-SCS safety
communication, the SCS link transmission, SOER, forcing, and connection with other
systems. You need to read this part if you want to know the above information.
Part B RAS (Reliability, Availability, Serviceability)
How the RAS (Reliability, Availability, Serviceability) are realized with SCS are explained
in this part including the information of SCS operating modes, diagnosis management,
error handling and redundancy. You need to read this part if you want to know the above
information.
Part C POU (Program Organization Unit)
How to use POU (Program Organization Unit) to create the application logics are explained
in this part. The functions and the function blocks specific to ProSafe-RS are explained. You
need to read this part if you want to know the above information.
Part D Integration with CENTUM
This part contains the information on SCS integration with CENTUM, i.e., the basic SCS
functions, interface with CENTUM for tag names, override operations from the CENTUM
operation and monitoring station (HIS), operations on manual operation function block, the
block behaviors, features of external communication function block and SCS Global Switch
communication in the case that ProSafe-RS is integrated with CENTUM. You need to read
this part if you want to know the above information.
Media No. IM 32S03B10-21E (CD) 3rd Edition : Dec. 2009 (YK) IM 32S03B10-21E 3rd Edition : Dec.22,2009-00
All Rights Reserved Copyright 2008, Yokogawa Electric Corporation
ii
ProSafe-RS Document Map

Safety System
Engineering
Safety Manual
Guide
IM 32S01S10-21E IM 32S01C10-21E
Software
Safety Control Station Integration with Open Interfaces

Reference CENTUM VP/CS 3000
IM 32S03B10-21E IM 32S01E10-21E IM 32S05B10-21E
Engineering Utilities and Messages

Reference Maintenance
Reference
IM 32S04B10-21E IM 32S04B20-21E IM 32S02B10-21E
ProSafe-RS
Integration with
System Test
FAST/TOOLS Workbench Users Guide
Reference
IM 32S04B30-21E IM 32S56H20-21E
Hardware Vnet/IP
Safety Control
Communication ProSafe-RS
Stations
Devices Vnet/IP
(Hardware)
IM 32S06C10-21E IM 32S06H10-21E IM 32S56H10-21E
Installation
Installation Manual
Software Help
IM 32S01C50-21E
Read Me First
IM 32S03B10-21E 2nd Edition : Dec.15,2008-00

iii
Safety Precautions
n Safety, Protection, and Modification of the Product
In order to protect system controlled by this product, the product itself and ensure safe
operation, observe the safety precautions described in this users manual. We assume no
liability for safety if users fail to observe these instructions when operating the product.
You must use this product according to the instructions described in user manuals. If not,
protective functions of this product may not work as expected.
If any protection or safety circuit is required for system controlled by the product or for the
product itself, prepare it separately.
Be sure to use the parts approved by Yokogawa Electric Corporation (hereafter simply
referred to as YOKOGAWA) when replacing parts or consumables.
Modification of the product is strictly prohibited.
The following symbols are used on the product and in this user manual to indicate that
safety precautions are required:
Indicates that user must take caution. The symbol on the equipment refers the user to the
relevant manual to avoid potentially hazardous situations that may result in injury or death.
The symbol appears next to the cautionary information in user manuals required to avoid
harm to personnel and to the equipment.
Indicates a protective grounding terminal. Before using the product, ground the terminal.
Indicates a functional grounding terminal. Before using the product, ground the terminal.
Indicates an AC supply.
Indicates a DC supply.
Indicates that main switch is ON.
Indicates that main switch is OFF.
IM 32S03B10-21E 1st Edition : May 30,2008-00

iv
n Notes on Handling User Manuals

Please hand over user manuals to your end users so that they can have them on hand for
convenient reference.
Please read the user manuals thoroughly before using the product.
The purpose of these user manuals is not to warrant that the product is well suited to any
particular purpose but rather to describe the functional details of the product.
YOKOGAWA reserves the right to make improvements in the user manuals and product at
any time, without notice or obligation.
If you have any questions, or you find mistakes or omissions in the user manuals, please
contact our sales representative or your local distributor.
n Warning and Disclaimer

The product is provided on an as is basis. YOKOGAWA shall have neither liability nor
responsibility to any person or entity with respect to any direct or indirect loss or damage arising
from using the product or any defect of the product that YOKOGAWA can not predict in advance.
n Notes on Software
YOKOGAWA makes no warranties, either expressed or implied, with respect to the
softwares merchantability or suitability for any particular purpose, except as specified in the
terms of warranty.
This software may be used on one machine only. If you need to use the software on another
machine, you must purchase another copy of the software.
It is strictly prohibited to reproduce the product except for the purpose of backup.
Store the CD-ROM (the original medium) in a safe place.
It is strictly prohibited to perform any reverse-engineering operation, such as reverse
compilation or reverse assembling on the product.
No part of the product may be transferred, converted or sublet for use by any third party,
without prior written consent from YOKOGAWA.

Documentation Conventions
n Typographical Conventions
The following typographical conventions are used throughout the user manuals:
l Commonly used Conventions throughout User manuals:
Character strings in the following font and style:

Indicate that user must enter them in the relevant field or text box in the context.
Example:
FIC100.SV=50.0
Mark:
Indicates a space between character strings that must be entered.
Example: Calling the tuning view with the tag name of S0001 on HIS (Human Interface Station of
the integrated CENTUM).
S0001TUN
Character string enclosed by brackets ({ }):

Indicates an option that can be omitted.
Example: Parameters for calling the tuning view on HIS.
Tag name TUN {-window size} {=Display position}
l Conventions used to show Key or Button Operations:
Characters enclosed by square brackets ([ ]):

Characters enclosed by square brackets within any description of a key or button operation,
indicate either a key on the keyboard, a button name on a window, or an item displayed on a
window.
Example:
Click the [OK] button.
l Conventions of User Defined Folder

User-Defined Folder Name
If the path of a folder can be defined by users, it is written within parentheses.
Example: (RS Project Folder) \SCS0101
If the RS Project Folder is C: \MYRSPJT, the above path becomes: C: \MYRSPJT\SCS0101

vi
n Symbol Marks
Throughout this user manual, you will find that several types of symbols are used to identify
different sections of text. This section describes these icons.
CAUTION:
Indicates instructions that must be observed in order to prevent physical injury and death of
operator.
WARNING :
Indicates instructions that must be observed in order to prevent software or hardware from
being damaged or system from becoming faulty.
IMPORTANT :
Indicates important information required to understand operations or functions.
TIP:
Indicates additional information.
SEE :
ALSO
Indicates a source to be referred to.

Clicking a reference displayed in green can call up its source, while clicking a reference
displayed in black cannot.
n Drawing Conventions
Some drawings in the user manual may be partially emphasized, simplified, or omitted, for the
convenience of description.
Note that screen images in user manuals may be slightly different from the actual ones (for
example, display positions and case differences), and some show only example images.
n Integration with CENTUM

ProSafe-RS can be used by integrating with CENTUM VP or CENTUM CS 3000. In the Users
Manuals of ProSafe-RS, the integration with CENTUM VP or CENTUM CS 3000 is referred to as
Integration with CENTUM.
For the same features of CENTUM VP and CENTUM CS 3000 that have different feature names,
the name used in CENTUM VP will be referred to in the explanations. (For example, CENTUM
CS 3000 System Alarm Window and CENTUM VP System Alarm View have the same functions,
but only System Alarm View will be referred to when explaining this feature.) Nevertheless,
if there is any difference in functionality according to whether ProSafe-RS is integrated with
CENTUM VP or CENTUM CS 3000, the feature will be explained separately for both cases.
SEE
ALSO For information about the functions and usage of CENTUM VP components, see CENTUM VP Users
Manuals (IM) and related Technical Information (TI) and General Specifications (GS).
For information about the functions and usage of CENTUM CS 3000 components, see CENTUM CS 3000
Users Manuals (IM) and related Technical Information (TI) and General Specifications (GS).

vii
n About Explanation of System Behavior

In this manual, system behavior is explained assuming the use of the latest software and
hardware that Yokogawa provides at the publication of the manual. Wherever a topic needs
explanation of earlier revisions of software or hardware, a link to the required explanation is
provided so that you can read them according to your system.
n About Station Types

Safety control stations (SCS) are named as follows according to the CPU node (SSCx0S/
SSCx0D) and CPU module (SCP4x1) mounted in them.
SCSV1-S : SCS that uses SSC10S/SSC10D (SCP401 is installed)
SCSP1-S : SCS that uses SSC50S/SSC50D (SCP451 is installed)
SCSP2-S : SCS that uses SSC60S/SSC60D (SCP461 is installed)
To explain the functions of these different types of SCS, the following generic terms or
abbreviations may be used in this manual.
SCS : Generic term that denotes all types of SCS
SCSV : SCS connected on V net (this denotes SCSV1-S)
SCSP : SCS connected on Vnet/IP (this denotes SCSP1-S and SCSP2-S)
SCSV1 : Abbreviation for SCSV1-S
SCSP1 : Abbreviation for SCSP1-S
SCSP2 : Abbreviation for SCSP2-S
IM 32S03B10-21E 3rd Edition : Dec.22,2009-00

viii
Copyright and Trademark Notices

n All Rights Reserved
The copyright of the programs and online manuals contained in the DVD-ROM or CD-ROM shall
remain in Yokogawa.
You are allowed to print out the required pages of the online manuals for using the product,
however, you are not allowed to print out the entire document.
Except as stated above, no part of the online manual may be reproduced, either in electronic
or written form, registered, recorded, transferred, sold or distributed (in any manner including
without limitation, in the forms of paper documents, electronic media, films or transmission via the
network).
n Trademark Acknowledgments
CENTUM, ProSafe, Vnet/IP and STARDOM are registered trademarks of YOKOGAWA.
Microsoft, Windows, Windows Vista, Visual Basic, Visual C++ and Visual Studio are either
registered trademarks or trademarks of Microsoft Corporation in the United States and/or
other countries.
Adobe, Acrobat and Acrobat Reader are either registered trademarks or trademarks of
Adobe Systems Incorporated in the United States and/or other countries.
Ethernet is a registered trademark of XEROX Corporation.
Modicon and Modbus are registered trademarks of Schneider Electric SA.
PLC is a registered trademark of Rockwell Automation, Inc.
HART is a registered trademark of the HART Communication Foundation.
All other company and product names mentioned in this users manual are trademarks or
registered trademarks of their respective companies.
We do not use TM or mark to indicate those trademarks or registered trademarks used in
this users manual.

TocA-1
ProSafe-RS
Safety Control Station Reference
IM 32S03B10-21E 3rd Edition
CONTENTS
PART A SCS Common
A1. Overview of SCS......................................................................................A1-1
A2. SCS Hardware..........................................................................................A2-1
A3. Scan Period and Time Synchronization of SCS..................................A3-1
A3.1. Scan Period of SCS......................................................................................... A3-1
A3.1.1 Definition of SCS Scan Period..........................................................A3-2
A3.1.2 Automatic Extension Function for Scan Period of the
Application Logic Execution Function . ............................................A3-4
A3.1.3 Online Change of Scan Period of the Application
Logic Execution Function . ...............................................................A3-9
A3.2 Time Synchronization of SCS...................................................................... A3-10
A4. Process Data Inputs and Outputs.........................................................A4-1
A4.1 Flow of Process Data Inputs and Outputs................................................... A4-1
A4.2 Input and Output Variables............................................................................ A4-4
A4.3 Common Setting Items for Process Data Inputs and Outputs................ A4-10
A4.4 Items Set for Analog Inputs......................................................................... A4-14
A4.5 Items Set for Analog Outputs...................................................................... A4-23
A4.6 Items Set for Discrete Inputs....................................................................... A4-29
A4.7 Items Set for Discrete Outputs.................................................................... A4-34
A5. Inter-SCS Safety Communication.........................................................A5-1
A6. SCS Link Transmission..........................................................................A6-1
A6.1 Overview of SCS Link Transmission............................................................ A6-2
A6.2 Actions Taken for SCS Link Transmission when SCS is Unsteady.......... A6-7
A6.3 Forcing of SCS Link Transmission Data.....................................................A6-11
A7. SOER........................................................................................................A7-1
A7.1 Overview of SOER.......................................................................................... A7-1
A7.2 Event Collection.............................................................................................. A7-4
A7.3 Event Storage.................................................................................................. A7-8
A7.4 Management of Event Information when SCS is Unsteady......................A7-11

TocA-2
A8. Forcing.....................................................................................................A8-1
A8.1 Variable Locking............................................................................................. A8-2
A8.2 Variable Value Setting..................................................................................... A8-7
A8.3 Forcing Function Block Parameters........................................................... A8-10
A8.4 Forcing of Inter-SCS Safety Communication............................................ A8-12
A8.5 Applications of the Forcing Function......................................................... A8-16
A8.5.1 Application Debugging....................................................................A8-16
A8.5.2 Utilization of the Forcing Function in SCS Maintenance................. A8-18
A9. Connection with Other Systems . .........................................................A9-1

TocB-1
ProSafe-RS
CONTENTS
PART B RAS (Reliability, Availability, Serviceability)
B1. What is RAS (Reliability, Availability and Serviceability) of SCS?.....B1-1
B2. Operating Mode.......................................................................................B2-1
B3. Diagnostic Management Function and Diagnostic Information
Message...................................................................................................B3-1
B3.1 Diagnostic Management Function of SCS................................................... B3-2
B3.2 Notification of Diagnostic Information Messages....................................... B3-4
B4. Notification of Diagnostic Information using the IOM Report............B4-1
B4.1 IOM Report of AIO/DIO Modules . ................................................................. B4-2
B4.2 IOM Report of Serial Communication Modules......................................... B4-12
B5. Operations at SCS Startup.....................................................................B5-1
B6. Actions Taken at Error Occurrence and Recovery Procedure...........B6-1
B6.1 Actions Taken at Fatal Error Occurrence and Recovery Procedure......... B6-3
B6.1.1 Actions Taken at Occurrence of Errors Affecting the Entire System
and Recovery Procedure..................................................................B6-3
B6.1.2 Actions Taken at CPU Module Error Occurrence
and Recovery Procedure .................................................................B6-4
B6.1.3 Behavior at Abnormal Calculation....................................................B6-6
B6.2 Actions Taken at Major Error Occurrence and Recovery Procedure..... B6-10
B6.2.1 Actions Taken at Input Module Error Occurrence
and Recovery Procedure................................................................B6-11
B6.2.2 Actions Taken at Input Channel Error Occurrence
B6.2.3 Actions Taken at Output Module Error Occurrence
B6.2.4 Actions Taken at Output Channel Error Occurrence
B6.2.5 Actions Taken at Errors between CPU
and Input/Output Module and Recovery Procedure.......................B6-22
B6.2.6 Actions Taken at Error Occurrence for Optical ESB Bus Repeater
Devices ..........................................................................................B6-24
B7. Dual Redundancy....................................................................................B7-1
B7.1 Redundant Configuration in SCS.................................................................. B7-1
B7.2 CPU Redundant Status.................................................................................. B7-4
B7.3 Automatic Execution of IOM Download....................................................... B7-7

TocC-1
ProSafe-RS
CONTENTS
PART C POU (Program Organization Unit)
C1. Overview of POU.....................................................................................C1-1
C1.1 Types of Functions and Function Blocks.................................................... C1-1
C1.2 Common Specifications................................................................................. C1-7
C2. Safety Functions.....................................................................................C2-1
C2.1 MUXBOOL4 (BOOL-Type Multiplexer with 4 Entries)................................. C2-1
C2.2 MUXBOOL8 (BOOL-Type Multiplexer with 8 Entries)................................. C2-3
C2.3 MUXREAL4 (Real-Type Multiplexer with 4 Entries)..................................... C2-4
C2.4 MUXREAL8 (Real-Type Multiplexer with 8 Entries)..................................... C2-5
C2.5 SCALER (Scaler)............................................................................................. C2-6
C2.6 SEL_R (Real-Type Binary Selector).............................................................. C2-8
C2.7 SEL_T (TIME-Type Binary Selector).............................................................. C2-9
C2.8 IB_TO_V (Converter (IO_BOOL to Data Value))......................................... C2-10
C2.9 IB_TO_S (Converter (IO_BOOL to Data Status))........................................C2-11
C2.10 IR_TO_V (Converter (IO_REAL to Data Value))......................................... C2-12
C2.11 IR_TO_S (Converter (IO_REAL to Data Status))........................................ C2-13
C3. Safety Function Blocks..........................................................................C3-1
C3.1 REPEATTIMER (Repeat Timer)...................................................................... C3-1
C3.2 FILTER (First-Order Lag Filter)...................................................................... C3-4
C3.3 FILTER_S (First-Order Lag Filter with Data Status).................................... C3-6
C3.4 ANLG1OO2D (1oo2D Analog Voter).............................................................. C3-9
C3.5 ANLGVOTER (IO_REAL-Type Analog Voter)............................................. C3-15
C3.6 BOOLVOTER (IO_BOOL-Type BOOL Voter).............................................. C3-22
C3.7 ANLG_S (Analog Input Function Block with Data Status)....................... C3-25
C3.8 ANLGI (Analog Input)................................................................................... C3-33
C3.9 VEL (Velocity Limit Alarm)........................................................................... C3-38
C3.10 CTU (Count Up Counter).............................................................................. C3-41
C3.11 CTD (Count Down Counter)......................................................................... C3-43
C3.12 CTUD (Count Up/Down Counter)................................................................ C3-45
C3.13 B_TO_IB (Converter (Data Value and Status to IO_BOOL-Type Data)).. C3-47
C3.14 R_TO_IR (Converter (Data Value and Status to IO_REAL-Type Data)) .. C3-48
C3.15 ANN_FUP (First-up Alarm Annunciator).................................................... C3-49
C3.16 FUP_RST (First-up Alarm Annunciator Reset).......................................... C3-52

TocC-2
C4. Function Blocks for Inter-SCS Communication (Safety FBs)............C4-1
C4.1 PROD_B
(Inter-SCS Safety Communication BOOL-Type Data Producer)............... C4-2
C4.2 PROD_I
(Inter-SCS Safety Communication INTEGER-Type Data Producer).......... C4-4
C4.3 PROD_R
(Inter-SCS Safety Communication REAL-Type Data Producer)................ C4-6
C4.4 CONS_B
(Inter-SCS Safety Communication BOOL-Type Data Consumer)............. C4-8
C4.5 CONS_I
(Inter-SCS Safety Communication INTEGER-Type Data Consumer)...... C4-13
C4.6 CONS_R
(Inter-SCS Safety Communication REAL-Type Data Consumer)............ C4-16
C4.7 LTSND (Link Transmission Data Output)................................................... C4-19
C4.8 LTRCV (Safety Link Transmission Data Input).......................................... C4-21
C5. Function Blocks for Integration with CENTUM (Safety FBs).............C5-1
C5.1 Override Function Blocks.............................................................................. C5-1
C5.2 Grouping Override Function Blocks............................................................ C5-4
C5.3 PASSWD (Password)...................................................................................... C5-7
C5.4 MOB_11 (BOOL-Type Data Manual Operation Function Block with
Two-Position Answerback)............................................................................ C5-9
C5.5 MOB_21 (BOOL-Type Data Manual Operation Function Block with
Three-Position Answerback)....................................................................... C5-13
C5.6 MOB_RS (Auto-Reset BOOL-Type Data Manual Operation).................... C5-17
C5.7 MOA (Analog-Type Data Manual Operation).............................................. C5-20
C6. Interference-free Function Blocks.........................................................C6-1
C6.1 ANN (Annunciator).......................................................................................... C6-1
C6.2 SOE_B (BOOL-Type Data SOER).................................................................. C6-3
C6.3 SOE_I (INTEGER-Type Data SOER).............................................................. C6-5
C6.4 SOE_R (REAL-Type Data SOER)................................................................... C6-7
C6.5 LTFCS (Interference-free Link Transmission Data Input)........................... C6-9
C7. Subsystem Communication Function Blocks.....................................C7-1
C7.1 SCI_B (BOOL-Type Subsystem Communication Input)............................. C7-1
C7.2 SCI_I (INTEGER-Type Subsystem Communication Input)......................... C7-3
C7.3 SCI_R (REAL-Type Subsystem Communication Input)............................. C7-5
C7.4 SCO_B (BOOL-Type Subsystem Communication Output)........................ C7-7
C7.5 SCO_I (INTEGER-Type Subsystem Communication Output).................... C7-9
C7.6 SCO_R (REAL-Type Subsystem Communication Output).......................C7-11
C8. External Communication Function Blocks..........................................C8-1

TocC-3
C9. Safety System Function Blocks............................................................C9-1
C9.1 SYS_STAT (SCS Status Management)......................................................... C9-2
C9.2 SYS_FORCE (Forcing Status Management)................................................ C9-3
C9.3 SYS_FORCE_LT (SCS Link Transmission Lock Status Monitor).............. C9-6
C9.4 SYS_FORCE_BD
(Inter-SCS Safety Communication Forcing Status Management)............. C9-9
C9.5 SYS_LTSTS (SCS Link Transmission Reception Status Monitor).......... C9-12
C9.6 SYS_DIAG (Diagnostic Information Output).............................................. C9-15
C9.7 SYS_SECURE (Security Level Management)............................................ C9-17
C9.8 SYS_SEC_CTL (Security Level Protection)............................................... C9-19
C9.9 SYS_OVR (Override Function Blocks Management)................................ C9-21
C9.10 SYS_PSWD (Password Function Blocks Management).......................... C9-25
C9.11 SYS_ALLSD (Station Output Shutdown)................................................... C9-28
C9.12 SYS_IOSD (Module Output Shutdown)...................................................... C9-30
C9.13 SYS_IOALLST (All I/O Channels of SCS Status Indicator)....................... C9-32
C9.14 SYS_NODEST (All I/O Channels of Node Status Indicator)..................... C9-34
C9.15 SYS_OUTST (Output Module 8 Channels Indicator)................................ C9-36
C9.16 SYS_OUTST16 (Output Module 16 Channels Indicator).......................... C9-39
C9.17 SYS_INST (Input Module Status Indicator)................................................ C9-42
C9.18 SYS_CHST (Channel Status Indicator)....................................................... C9-44
C9.19 SYS_OUTEN (Output Module Status Indicator)........................................ C9-46
C9.20 SYS_CERR (Computation Error Indicator)................................................ C9-49
C9.21 SYS_SCANEXT (Scan Period Extension Indicator).................................. C9-51
C10. Interference-free System Function Blocks........................................C10-1
C10.1 SYS_SCAN (Execution Time Indicator)...................................................... C10-1
C10.2 SYS_TIME (SCS Clock Information)........................................................... C10-3
C10.3 SYS_ALARM (Diagnostic Information Status Indicator).......................... C10-4
C10.4 SYS_NETST (Control Bus Status Indicator).............................................. C10-6
C10.5 SYS_ESBINF (ESB Bus Status Indicator).................................................. C10-9
C10.6 SYS_NODEINF (Node Status Indicator)................................................... C10-11
C10.7 SYS_IOMDSP (IOM Status Indicator)........................................................ C10-13
C10.8 SYS_ALRDSP
(Subsystem Communication Module Status Indicator)......................... C10-15
C10.9 SYS_FORCE_SC
(Subsystem Communication Data Forcing Status Management)........... C10-17
C10.10 SYS_STAT_SC
(Subsystem Communication Output Status Indicator)........................... C10-19

TocD-1
ProSafe-RS
CONTENTS
PART D Integration with CENTUM
D1. Integration with CENTUM.......................................................................D1-1
D2. Tag Name Interfaces for CENTUM.........................................................D2-1
D2.1 Overview of Tag Name Interfaces................................................................. D2-2
D2.2 Tag Name Interfaces for Internal Variables
and Input/Output Variables............................................................................ D2-8
D2.3 Tag Name Interfaces of Function Blocks................................................... D2-12
D3. Override Operation from HIS.................................................................D3-1
D3.1 Overview of Override FB................................................................................ D3-2
D3.2 Tag Name Interfaces and Process Alarms of
Override Function Blocks.............................................................................. D3-4
D3.3 Overview of Grouping Override Function Block......................................... D3-9
Grouping Override Function Block............................................................. D3-13
D3.5 Status Management of Function Blocks Used for Override.................... D3-16
D3.6 Permission for Override by Password FB................................................. D3-18
Password Function Blocks.......................................................................... D3-22
D4. Manipulation of Manual Operation Function Blocks from HIS..........D4-1
D4.1 HIS Interfaces of MOB_11 and MOB_21
(BOOL-Type Data Manual Operation Function Block with Answerback) D4-3
D4.1.1 Manual Operation Permission Function.......................................... D4-8
D4.1.2 Password at Manual Operations..................................................... D4-9
D4.1.3 Output Enable Status Display Function......................................... D4-10
D4.1.4 Answerback Check Function..........................................................D4-11
D4.1.5 Monitoring IOP and OOP............................................................... D4-16
D4.1.6 Tag Name Interfaces and Process Alarms of MOB_11
and MOB_21.................................................................................. D4-17
D4.2 HIS Interfaces of MOB_RS
(Auto-Reset BOOL-Type Data Manual Operation).................................... D4-22
D4.2.1 Operations of MOB_RS from HIS.................................................. D4-22
D4.2.2 Tag Name Interfaces and Process Alarms of MOB_RS................ D4-27
D4.3 HIS Interfaces of MOA (Analog-Type Data Manual Operation)................ D4-30
D4.3.1 Operations of MOA from HIS......................................................... D4-30
D4.3.2 Tag Name Interfaces and Process Alarms of MOA....................... D4-32

TocD-2
D5. Data Setting Using External Communication Function Blocks.........D5-1
D5.1 Confirmation of Setting Data......................................................................... D5-2
D5.2 Tag Name Interfaces of External Communication Function Blocks......... D5-3
D6. SCS Global Switch Communication.....................................................D6-1
D6.1 Referencing FCS Data from SCS.................................................................. D6-1
D6.2 Data Setting from SCS to FCS....................................................................... D6-3

<A1. Overview of SCS> A1-1
A1. Overview of SCS

The ProSafe-RS SCS (Safety Control Station) is a station dedicated for safety control
applications.
The SCS consists of the function that monitors the safety conditions of the plant, the
application logic execution function that performs pre-determined safety operations
according to each safety control request and the external communication function that
communicates information with devices other than SCSs.
There are two types of Safety Control Units of ProSafe-RS: one is connected to V net
(SSC10S/SSC10D) and the other connected to Vnet/IP (SSC60S/SSC60D and SSC50S/
SSC50D). SSC60S/SSC60D are high-speed and large capacity SCSs.
n Overview of SCS Software Configuration

The two main functions of the SCS are the application logic execution function that detects
hazardous process conditions and prevent or mitigate hazardous events and the external
communication function, that communicates information with CENTUM. With the above
functions, the data are exchanged with the V net stations through the communication function. If
data is written to the application logic execution function, the memory within the SCS is protected
by security level and other safety measures.
CENTUM
FCS PRM
(managing HART devices)
SENG HIS
SCS
PC
Control bus
SCS
Communication function
DCS of other
companies
(Higher-level System)
Application logic
execution function External
communication function
RS-232C
Application logic
/RS-422
execution
/RS-485
Process data Subsystem
input/output function
Communication data RS-232C

input/output function /RS-422
/RS-485
Inter-SCS safety
communication function HART Device
SCS Link
Transmission function
Diagnostic function
A010101E.ai
SENG: Station that handles engineering and maintenance of SCS

HIS: Station that executes operation and monitoring of CENTUM
FCS: Control station of CENTUM
PRM: Plant Resource Manager
Figure Overview of SCS Function Configuration

n Application Logic Execution Function

This function monitors the safety condition of the plant and makes the process shift to the safety
state on detecting any hazards. It mainly performs the following processing.
Inputting process data from the field
Execution of user-defined application logic
Outputting process data to the field
Communication data I/O (Subsystem communication)
Inter-SCS safety communication
SCS Link Transmission
Self-diagnosis
l Application Logic
An SCS executes application logic written in the IEC 61131-3 program language. The application
logic is defined by the user using Multi Language Editor and downloaded to the SCS.
An SCS supports the following three languages of IEC 61131-3:
Function Block Diagram (FBD)
Ladder Diagram (LD)
Structured Text (ST)
SEE
ALSO For more information about Function Block Diagram (FBD) and Ladder Diagram (LD), see the following:
PART-C POU
For more information about Structured Text (ST), see the following:
2.5, Structured Text of the Engineering Guide (IM 32S01C10-21E)
TIP
The application logic execution function explained here is not simply a name for a function that handles execution
of the application logic; rather, it is a generic name for all the functions explained above, including the actual
execution of the application logic. In this manual, this term is used in the following explanation as well.

n External Communication Function

This is a function for exchanging information with external systems connected to an SCS and
it does not influence the application logic execution function. It mainly performs the following
processing:
CENTUM integration function
SOER function
Modbus slave communication function
Diagnostic information collection function
PRM-supported HART on-demand communication
l PRM-supported HART On-demand Communication

On-demand communication with a HART device is implemented by PRM issuing a HART
command, and then receiving a response from the HART device via the SCS. Analog Input/
Output modules with HART function serve as communication relays. Specifically, they receive
HART communication frames from PRM and send them directly to HART devices, while
receiving HART communication frames from HART devices and returning them directly to PRM.
n SCS Databases
SEE
ALSO For details on SCS database types, see the following:
2.6, Capacity of SCS Applications of the Engineering Guide (IM 32S01C10-21E)
n Scan Period and Time Management

For the scan period and time management of the SCS, refer to the explanations in the related
sections specified below.
SEE
ALSO For the scan period and processing timings, see the following:
2.7, Performance and Scan Period in SCS of the Engineering Guide (IM 32S01C10-21E)
For the time synchronization, see the following:
2.14, Time Synchronization of the Engineering Guide (IM 32S01C10-21E)
For the clock setting operation, see the following:
3.1.5, Setting System Time of the Utilities and maintenance Reference (IM 32S04B20-21E)

<A2. SCS Hardware> A2-1
A2. SCS Hardware

This chapter provides an overview of the hardware configuration of an SCS.
Status display of the CPU module
Types of input/output modules
SEE
ALSO For the SCS hardware configuration and hardware devices that comprise the overall system, see the
following:
2.2, Hardware Configuration of the Engineering Guide (IM 32S01C10-21E)
For the system size and hardware installation conditions, see the following:
2.3, Requirements for the Size of System and Installation of Hardware of the Engineering Guide (IM
32S01C10-21E)
For the SCS hardware configuration changes those can be performed by online change download, see the
following:
5.2, List of Applicable Items for On-line Change of the Engineering Guide (IM 32S01C10-21E)
n CPU Module
l Combination of CPU Nodes and CPU Modules

Applicable combinations of CPU nodes and CPU modules are in the following table:
Table Combinations of CPU Nodes and CPU Modules
CPU Node Type CPU Module
SSC10S/SSC10D SCP401
SSC50S/SSC50D (*1) SCP451 (*1)
SSC60S/SSC60D (*2) SCP461 (*2)
*1: Supported in SCS system program R1.02 or later.
*2: Supported in SCS system program R2.03 or later.
l Definition of SCS Station Types

Define a station type matching the hardware in the SCS Project Properties window called from
SCS Manager. If a CPU module not supported by the defined station type is installed on the
control side of SCS, a warning is displayed at off-line download. The CPU module will not start
even if off-line download is executed ignoring the warning. If a correct CPU module is installed
on the control side but a CPU module different from the definition is installed on the standby side,
the CPU module on the standby side will not start.
IM 32S03B10-21E 3rd Edition : Dec 22,2009-00

l LED Display
SCP401
The following information is displayed in the LEDs of the CPU module (SCP401) installed in
the SSC10S/SSC10D.
Table LEDs of SCP401
LED Quantity On Off
HRDY 1 The CPU hardware is normal A CPU hardware failure has occurred
RDY 1 Control is possible A fatal hardware/software failure has occurred
CTRL 1 The CPU module is in the CTRL status The CPU module is in the RDY or STBY status
COPY 1 During APC Not during APC
RCV 2 V net bus 1/bus 2 receiving V net bus 1/bus 2 not receiving
SND 2 V net bus 1/bus 2 sending V net bus 1/bus 2 not sending
Synchronized to the V net time or the
SYNC 1 Not synchronized to the IRIG-B time
IRIG-B time
SCTY 1 Online level (*1) Offline level (*1)
*1: Security level 0 corresponds to offline level and security levels 1 and 2 correspond to online level.
SCP461/SCP451
The following information is displayed in the LEDs of the CPU module (SCP461) installed in
the SSC60S/SSC60D and the LEDs of the CPU module (SCP451) installed in the SSC50S/
SSC50D.
Table LEDs of SCP461/SCP451
LED Quantity On (*1) Off
HRDY 1 The CPU hardware is normal A CPU hardware failure has occurred
RDY 1 Control is possible A fatal hardware/software failure has occurred
CTRL 1 The CPU module is in the CTRL status The CPU module is in the RDY or STBY status
COPY 1 During APC Not during APC
RCV 2 Vnet/IP bus 1/bus 2 receiving Vnet/IP bus 1/bus 2 not receiving
SND 2 Vnet/IP bus 1/bus 2 sending Vnet/IP bus 1/bus 2 not sending
The time synchronization function of the CPU
SYNC 1 Synchronized to the Vnet/IP time (*2)
module is faulty.
SCTY 1 Online level (*3) Offline level (*3)
*1: The RCV and SND LED blink.
*2: Whether or not an SNTP server is connected to the network does not affect the LED On condition.
*3: Security level 0 corresponds to offline level and security levels 1 and 2 correspond to online level.
The following communication statuses are indicated by combinations of RCV and SND statuses
(blinking or off). If a communication error has occurred, the network location where the error
occurred can be identified easily using the Network Status Display dialog box on the HIS.
Table SND/RCV LED Statuses and Communication Statuses
SND RCV Communication Status
Off Off Communication disconnected
Blinking Blinking Normal (within the network connected by the layer 2 switch)
No other communication station is available (including a situation where only one SCS is
Blinking Off
connected to the network and its CPU module is operating in the single operation status)
Off Blinking The CPU module is faulty
SEE
ALSO For more information about the LED display of a CPU module, see the following:
4.2.2, LED Display of the Safety Control Stations (Hardware) (IM 32S06C10-21E)

The LEDs are positioned on the CPU module as shown in the figure below.
RCV 1 2 RCV LED

SND 1 2 SND LED
SYNC SCTY
1 2 3 4 5 6 7 8 STATUS LED
HRDY RDY CTRL COPY
COPY LED
CTRL LED
RDY LED
HRDY LED
A020001E.ai
Figure LED Layout on the Front of the CPU Module
The STATUS LEDs 1 to 8 can display either the status information or the domain/station number
of SCS depending on the display setting switch.
The meaning of each LED when the status information of the SCS is displayed is summarized in
the table below. The SCS can be judged as operating normally if all the LEDs from 1 to 8 are lit.
Table LEDs Indicating SCS Status
LED Display Description
Running mode: Both LED 1 and LED 2 turn on.
1, 2 Display of the operating mode Waiting mode: LED 1 turns off and LED 2 turns on.
Other modes: Both LED 1 and LED 2 turn off.
3 Tentative change of the security level LED 3 turns on only when the security level is 2.
LED 4 turns off if an error that does not involve user
4 An SCS error occurred (*1) operations has occurred in the system.
LED 4 turns on if there is no error.
5 to 7 Not used Always lit
Indicates a status of writing to the
8 LED 8 turns off while writing to the flash memory.
flash memory
*1: LED4 is interlocked with the output of the SYS_DIAG function block.
SEE
ALSO For more information about how to set LEDs 1 to 8 to display the V net address, see the following:
4.2.3, Setting Switches of the Safety Control Stations (Hardware) (IM 32S06C10-21E)
IM 32S03B10-21E 3rd Edition : Dec 22,2009-00

n HKU (House Keeping Unit)

The HKU function in the CPU module monitors the operation environment of the CPU module.
An error in the CPU operating environment is notified to the user via diagnostic information
messages and status display window. The following items are monitored by the HKU function.
CPU node fan status
Temperature in the vicinity of the CPU node
Battery temperature
n Types of Input/Output Modules

Analog input/output module
Discrete input/output module
Communication module
The modules above are collectively called input/output modules. Communication modules that
can be installed in SCS are serial communication modules.
TIP
In the explanation in this document, analog input/output modules and discrete input/output modules are
collectively referred to as AIO/DIO modules. Analog input modules and discrete input modules are collectively
referred to as input modules, while analog output modules and discrete output modules are collectively referred
to as output modules.
l Analog Input/Output Modules

Analog input/output modules are used to input/output analog signals indicating electrical current,
voltage, etc. The types (models) of analog input/output modules are shown below.
Table Specification of Analog Input/Output Modules
Classification Model Description Number of channels Redundancy SIL support
SAI143 4 to 20 mA, isolated 16 Allowed 3
Analog input
SAV144 1 to 10 V, isolated 16 Allowed 3
Analog output SAI533 4 to 20 mA, isolated 8 Allowed 3
SAI143
An analog input module for electrical current. Modules whose suffix code is SAI143-H
support HART communication and are indicated as SAI143H in the SCS State Management
Window on the SENG or the Status Display view on the HIS. SAI143-H can be used with
software release number of R1.02.00 or later.
SAV144
An analog input module for electrical voltage.
SAI533
An analog output module for electrical current. This module can be used with software
release number of R1.02.00 or later. These modules are indicated as SAI533H in the SCS
State Management Window on the SENG or the Status Display view on the HIS. This
module supports HART communication.

l Discrete Input/Output Modules
Discrete inputs and outputs are process inputs and outputs that use discrete on/off signals.
The following two input/output module types (model names) are used for discrete inputs and
outputs.
Table Specification of Discrete Input/Output Modules
Classification Model Description Number of channels Redundancy SIL support
Discrete input SDV144 24 V DC, module isolation 16 Allowed 3
SDV521 24 V DC, module isolation 4 Allowed 3
100-120 V AC, module
SDV526 4 Allowed 3
isolation
Discrete output SDV531 24 V DC, module isolation 8 Allowed 3
SDV531-L 24 V DC, module isolation 8 Allowed 3
SDV53A 48 V DC, module isolation 8 Allowed 3
SDV541 24 V DC, module isolation 16 Allowed 3
SDV144
A discrete input module. This module provides SOER (Sequence of Events Recorder)
function.
SDV521
A 4-channel discrete output module. This module can be used with software release number
of R1.03.00 or later.
SDV526
A 4-channel 100-120 V AC discrete output module. This module can be used with software
release number R2.02 or later.
TIP
In the case of SDV526, short circuits between channels cannot be detected. In addition, the following faults
cannot be detected while SDV526 is outputting OFF signals.
- Short circuits in output wiring
- Output overload (faults in field devices that cause short circuits or overcurrent when the modules output
is set to ON)
The signals (ON or OFF) output to SDV526 by the application logic must be held for at least one second so
as to ensure detection of faults inside the module or notification of diagnostic information.
SDV531
An 8-channel discrete output module.
SDV531-L
An 8-channel discrete output module for long distance. This module can be used with
software release number of R1.03.00 or later.
SDV53A
An 8-channel 48 V DC discrete output module. This module can be used with software
release number of R2.03.00 or later.
SDV541
A 16-channel discrete output module. This module can be used with software release
number of R1.02.00 or later.
SEE
ALSO For more information about the SOER function of a DI module, see the following:
A7.2, Event Collection

l Serial Communication Modules
Serial communication modules are used for Modbus slave communication between an SCS and
an external device acting as the Modbus master, and for subsystem communication between an
SCS and its subsystem.
ALR111: Serial communication module (RS-232C)
An interference-free communication module providing an RS-232C interface
ALR121: Serial communication module (RS-422/RS-485)
An interference-free communication module providing an RS-422 or RS-485 interface
SEE
ALSO For details on Modbus slave connection, see the following:
B1, Modbus Slave Connection of the Open Interfaces (IM 32S05B10-21E)
For details on using a serial communication module for subsystem communication, see the following:
Subsystem Communication Function in 2.16, Connection with Other Systems via Serial
Communication of the Engineering Guide (IM 32S01C10-21E)
Note the following cautions when implementing the serial communication modules.
Modbus slave communication and subsystem communication cannot be performed
simultaneously within a single serial communication module.
When used for Modbus slave communication, serial communication modules cannot have a
redundant configuration. If redundancy is required, use two serial communication modules
and provide redundancy using a user application.
A serial communication module can be configured as a redundant module if used for
subsystem communication.
The serial communication module for Modbus slave communication cannot be installed to
an I/O node that is connected with the optical ESB bus repeater module and installed at a
distance longer than 5 km on the SCSP network.

<A3.1 Scan Period of SCS> A3-1
A3. Scan Period and Time

Synchronization of SCS
This chapter explains the scan period and time synchronization of SCS.
A3.1. Scan Period of SCS

This section explains the following items related to the scan period of SCS.
Definition of the scan period of SCS
Automatic extension function for the scan period of the application logic execution
function (*1)
Online change of scan period of the application logic execution function (*1)
*1: Supported in the SCS of SCS system program R2.03 or later.
n Overview of Scan Period of SCS

There are two types of scan periods of SCS, the scan period of the application logic execution
function and the scan period of the external communication function. The scan period of the
application logic execution function can be changed online.
SCS has the automatic extension function for the scan period of the application logic execution
function. This function automatically extends the scan period of the application logic execution
function when the load on SCS becomes high. Use the SCS Constants Builder to specify
whether or not to use this function.

A3.1.1 Definition of SCS Scan Period

This section describes the definition of the SCS Scan period and how to define it.
n Scan Periods in SCS

The periodic processing for SCS falls into two types. : Application Logic Execution Function and
External Communication Function. They are executed at their respective scan periods.
Application Logic
Execution Function
A scan period for Application Logic Execution Function
External Communication
Function
A scan period for External Communication Function

Idle time A030101E.ai
Figure Scan Periods of SCS
The Application Logic Execution Function is the function having a top priority among SCS
functions. The External Communication Function is executed in a part where the Application
Logic Execution Function is not executed in the CPU processing period. If the External
Communication Function finishes its processing before a scan period ends, the remaining time
becomes the idle time on CPU.
l Processing of Application Logic Execution Function

The Application Logic Execution Function is executed in the order presented as follows.
1 2 3 4 5 1 2 3 4 5
Scan period
A030102E.ai
Figure Processing of Application Logic Execution Function
Table Processing of Application Logic Execution Function

Order Processing Name Details
1 Input process data Collects process data from input modules, and generates data
Self-diagnosis values and data status. Stores the generated data in the input
variables. Also, the self-diagnostics is executed at this timing.
2 Receive data from other SCS Receives the data from other SCSs, and stores them to the
variables. (Applicable to inter-SCS safety communication and SCS
link transmission)
3 Execute Application Logic Executes application logic in FBD and LD.
4 Transmit Data to other SCS Transmits data to other SCSs. (Applicable to inter-SCS safety
communication and SCS link transmission)
5 Output process data Collects the data from output variables, and writes the data to the
Self-diagnosis output modules. The self-diagnostic processing is executed at this
timing.
The processing time of the Application Logic Execution Function may be prolonged by about
20% at maximum because of the increase in the CPU load caused by communication for tag
data access or some other processing.

l Processing of External Communication Function
The External Communication Function is a general name for functions of communicating
information of SCS with external systems. CENTUM Integration Function and Modbus Slave
Communication Function are included in it.
n Specification of Scan Period of the Application Logic Execution

Function
The scan period of the application logic execution function is specified on the Link Architecture
View of SCS Manager. Select [Edit] and then [Properties] to call the Resource Properties window,
enable the [Trigger cycles] check box in the [Settings] tab, and specify the value in [Cycle Timing].
The scan period can be specified in the range from 50 ms to 1000 ms in increments of 10
ms.
The specified scan period can be changed online (*1).
SEE
ALSO For more information about the Link Architecture View, see the following in the Workbench of the Workbench
Users Guide:
Runtime Setting in Editing Resource Properties of Link Architecture View
n Specification of Scan Period of the External Communication Function

The scan period of the external communication function is specified in the SCS Constants
Builder. Specify the value in [Scan Period for External System] in the [Communication] tab.
Either 1 second or 2 seconds can be specified.
The default is 1 second.
Off-line download is required to change the specified scan period.
n Watching Scan Run time

While the SCS system program runs successfully, the Watch Dog Timer (WDT) is periodically
reset. The WDT is for self-diagnosing the cyclic operations.

A3.1.2 Automatic Extension Function for Scan Period of the

Application Logic Execution Function
In such a case as when the SCS has to perform very large amount of communication to
access tag data, the processing time of the Application Logic Execution Function may be
prolonged. If the amount of application is large and there is insufficient idle time before
the next scan period starts, the SCS does not have sufficient time for the processing of
communication on the control bus and for the External Communication Function that
is done during the intervals between executions of the Application Logic Execution
Function.
In such conditions, some functions such as the CENTUM integration function are
affected. If high-load conditions continue steadily, inter-SCS safety communication may
also be affected.
To avoid such adverse effects, you need to design the application logic so as to ensure
the recommended CPU idle time given in the Engineering Guide.
If you anticipate that the SCS cannot maintain sufficient CPU idle time because of
underestimating the amount of application logic at initial engineering or the modification
of the SCS project, you can specify the use of the automatic scan period extension
function in order to avoid the adverse effects (*1).
IMPORTANT
The purpose of this function is to temporarily avoid occurrences of erroneous conditions in
SCS. SCS cannot maintain the assumed process safety time if the automatic scan period
extension function is executed. Thus, take permanent measures such as reducing the amount of
application logic in order to lower the CPU load on the SCS.
It is possible to check if the scan period has been automatically extended on the SENG or Status
Display view of HIS as well as via diagnostic information messages. It is also possible to create
application logic for confirming the state of scan period extension.

n Automatic Scan Period Extension Function

In order to use the automatic scan period extension function, it is necessary to make the
specification in the SCS Constants Builder. The function operates only when specified. The
specification can be changed by online change download.
SEE
ALSO For more information about how to specify automatic extension of scan period on the SCS Constants Builder, see
the following:
3.1.3, SCS Constants Builder of the Engineering Reference (IM 32S04B10-21E)
l Overview of Automatic Extension of Scan Period

If the processing of the Application logic Execution Function is prolonged and almost occupies
the whole scan period of the Application logic Execution Function defined in SCS Manager,
the SCS cannot perform the processing for the communication on the control bus and for the
External Communication Function that is done during the intervals between executions of the
Application Logic Execution Function.
Processing of Application logic Processing for control bus communication and
Execution Function External Communication Function
At normal condition
Scan period of Application logic

Execution Function
Processing time for control bus communication and
External Communication Function is not enough.
At high-load
(Before extension)

Execution Function
A030103E.ai
Figure Example of the Case when the Scan Period is Automatically Extended
The automatic scan period extension function automatically extends the scan period of the
Application logic Execution Function when high-load conditions occur and ensures sufficient
time for the processing of communication on the control bus and for the External Communication
Function that is done during the intervals between executions of the application logic.
Scan period of Application logic Execution Function is extended
to ensure sufficient processing time for control bus processing
and External Communication Function.
At high-load
(After extension)

Execution Function
Extension
A030104E.ai
Figure State in which the Scan Period is Automatically Extended
By using the automatic scan period extension function, the time for the communication
processing related to the following features are ensured.
Inter-SCS safety communication
CENTUM integration
Communication with SENG
Diagnostic information message, process alarm notification

l Conditions of Starting Scan Period Extension
High load status is defined as status where one of the following conditions is met.
The execution time of the application logic execution function exceeds 80% of the original
scan period of the application logic execution function and the CPU idle time becomes 0.
Or,
The execution time of the application logic execution function exceeds 100% of the original
scan period of the application logic execution function.
If this high load status continues for 1 second or longer, the scan period of the application logic
execution function is automatically extended.
The new scan time is obtained by adding 20% of the original scan period of the application logic
execution function to the actual measurement of the application execution time at that time.
l Influence until Activation of Scan Period Extension

The following situations may occur before the automatic scan period extension period is activated
after the SCS is placed under high load status.
Stopping of CENTUM integration data update
Delay of diagnostic information message notification
Stopping of forcing data update
Stopping of status display in the SCS State Management window
l Upper Limit of Scan Period Extension

The upper limit of scan period extension is 200% of the original scan period of the application
logic execution function. Note that the extended scan period will never exceed the upper limit
value of 1 second.
l Cancellation of Scan Period Extension

If both high load conditions explained in item Conditions of Starting Scan Period Extension are
removed, the scan period becomes shorter by each scan in decrements of 20% of the original
scan period of the application logic execution function. Note that the scan period will never
become shorter than the scan period of the application logic execution function defined in SCS
Manager.

n Notification of Execution/Cancellation of Automatic Scan Period

Extension
If the automatic scan period extension function is activated on the SCS, it is notified via the
diagnostic information message (No. 4143). The cancellation of extension is notified via the
diagnostic information message of automatic scan period extension cancellation (No. 4144).
SEE
ALSO For more information about diagnostic information messages, see the following of the Messages (IM 32S02B10-
21E):
No. 4143 Start of automatic scan period extension
No. 4144 Cancellation of automatic scan period extension
If automatic scan period extension is continuously activated for a certain period of time or
longer, the diagnostic information message indicating the start of the automatic scan period
extension function is notified to give warning again. The default interval of re-warning is 10
minutes.
The interval of re-warning can be changed using the SYS_SCANEXT system function
block.
The system function block (SYS_SCANEXT) can be used to determine whether the
automatic scan period extension function is being executed via application logic (*1).
*1: The SYS_SCANEXT system function block can be used in new SCS databases created by SENG of R2.03.00 or later.
SEE
ALSO For more information about SYS_SCANEXT, see the following:
C9.21, SYS_SCANEXT (Scan Period Extension Indicator)
If the scan period of the application logic execution function is changed via online change
download while the scan period is being automatically extended, the scan period extension
status is cancelled after the completion of the online change download and the diagnostic
information message on cancellation of scan period automatic extension is notified.
However, if the high CPU load continues even after the scan period is changed and if
the conditions for automatic scan period extension are met, the scan period is extended
automatically.
The SCS State Management window of SENG and the Status Display view of HIS (*1)
display both the scan period of the application logic execution function defined in SCS
Manager and the actual scan period of the application logic execution function of SCS.
*1: Supported in CENTUM VP R4.02 or later.

n Influence of Automatic Extension of Scan Period

Automatic extension of the scan period has the following influence.
l Influence on Process Safety Time

Since the reaction time is determined based on the scan period of the application logic execution
function, the time also becomes longer accordingly if the scan period is extended.
SEE
ALSO For precautions on engineering related to automatic expansion of scan period, see the following:
2.7, Performance and Scan Period in SCS of the Engineering Guide (IM 32S01C10-21E)
l Influence on Test Functions

The automatic scan period extension function does not operate in SCS simulation tests and logic
simulation tests.
l Influence on Function Blocks

SYS_SCAN Function Block
The current scan period of the application logic execution function of SCS is output to the
output parameter SCAN of the SYS_SCAN function Block.
Function Blocks Handling Time
There is no influence of changes in scan period on the operations of function blocks
handling time. Those function blocks operate according to the actual time even if the scan
period is changed.
Function Blocks Handling Execution Count
In the case of function blocks whose output is determined by the number of calls, the
number of outputs within the unit time decreases if the scan period is extended.
Targets: CTU, CTD, CTUD, FILTER, FILTER_S

A3.1.3 Online Change of Scan Period of the Application

Logic Execution Function
The scan period of the application logic execution function can be changed online in the
case of SCS with SCS system program R2.03 or later.
n Overview of Scan Period Online Change

Change the scan period of the application logic execution function with SCS Manager and
execute online change download under security level 1 or lower. The SCS will then operate with
the specified scan period after download completes. If automatic extension of scan period has
been enabled on the SCS, the automatic scan period extension status is cancelled after the
completion of online change download and the SCS resumes operation with the scan period
specified with the online change.
n Limitations on Online Change

The allowable range of change is the same as the allowable range of specification, i.e., from 50
ms to 1000 ms in increments of 10 ms. Note that in online change, it is not allowed to set a scan
period longer than the scan period before change by more than 250 ms. If such changes are
made, an error occurs at online change download.
Example) It is possible to change the scan period from 250 ms to 500 ms. Change from 250 ms
to 550 ms is not allowed because it represents an increase of 300 ms.
When changing to a shorter scan period, a dialog box appears, showing the expected CPU idle
time after the scan period is changed. You cannot download if the expected CPU idle time is 0
second.
n Occurrence of IOM Download at Online Change Download

If the scan period defined before or after execution of online change is longer than 250 ms, IOM
download processing is executed for all AIO/DIO modules used in the given SCS to notify the
change of fallback time. In this case, a confirmation dialog box appears at the start of online
change download.
There is no influence on control operation during online change download because the
control of AIO/DIO modules continues.
Online change download on SENG is completed after the completion of IOM download to all
AIO/DIO modules. IOM download takes approximately 5 seconds per module.
n Notification of Scan Period Online Change

When online change download performed at scan period change is completed, the diagnostic
information message of scan period online change (No. 4152) is notified, in addition to the
diagnostic information message of online change download completion.
SEE
ALSO For more information about the diagnostic information message, see the following:
No. 4152 On-line change of scan period of the Messages (IM 32S02B10-21E)

<A3.2 Time Synchronization of SCS> A3-10
A3.2 Time Synchronization of SCS

An SCS has a function to synchronize time information among SCSs as well as CPU and
DI modules in order to maintain the accuracy of the time stamps of event information.
SCSs connected to V net and those connected Vnet/IP use different time synchronization
methods.
n Method of Synchronization with Reference Time
l Time Synchronization Methods of SCSs Connected to V net

There are the following two time synchronization methods, from which the user can select the
more appropriate one for the given application.
Table Time Synchronization Methods
Method Description Setting method
V net time Select [V net] as the time
Uses the mechanism for synchronizing time of each
synchronization synchronization method in SCS
station connected to V net.
(standard) Constants Builder. (*1)
Uses the GPS unit as the standard time server. If
Connect a commercially available
this output (IRIG-B) is connected to each SCS, the
IRIG-B time GPS unit and a connector on the
standard time (date, hour, minute, second) and the
synchronization CPU node with IRIG-B. Select
synchronization timing are distributed. Each SCS is
(option) [IRIG-B] as the time synchronization
synchronized with this timing. Since GPS is used, it is
method in SCS Constants Builder.
possible to acquire events with high time accuracy.
*1: The standard time is specified by the user using SCS Maintenance Support Tool of the SENG or the Adjust Time dialog box of an
HIS.
SEE
ALSO For more information about time setting operations, see the following:
3.1.5, Setting System Time of the Utilities and Maintenance Reference (IM 32S04B20-21E)
For more information about SCS Constants Builder, see the following:
l Time Synchronization Method of SCSs Connected to Vnet/IP

The time synchronization method of SCSs connected to Vnet/IP is fixed to the synchronization
with Vnet/IP time. If an SNTP server is installed, it is possible to achieve highly accurate time
synchronization with the standard time.
The time synchronization status can be checked in the SCS State Management Window of the
SCS Maintenance Support Tool on the SENG, or in the SCS Status Display view on the HIS.
SEE
ALSO For details on Vnet/IP time synchronization, see the following:
A4, Time Synchronization of Vnet/IP of the ProSafe-RS Vnet/IP (IM 32S56H10-21E)
l Time Broadcast to DI Modules

The CPU broadcasts the time to DI modules mounted in the station every second.

n Configuration of Each Time Synchronization
l V net Time Synchronization

With the V net time synchronization, the user can set the time using SCS Maintenance Support
Tool of the SENG or the Adjust Time dialog box of an HIS.
V net time master

(SENG or HIS) HIS FCS
V net time V net time V net time
Time synchronization V net

SCS Other SCSs
CPU CPU
V net time V net time
Time setting
DI module
V net time
A030201E.ai
Figure V net Time Synchronization
TIP
If the diagnostic information message, GPS Interface Unit Error is notified when the V net time synchronization
is selected, the CPU module need not be replaced if the following conditions are met. Since this message does
not present any problem in practical operations or on safety, you can continue to operate the system.
If the message is generated only on the control-side CPU module in the redundant configuration
immediately after completion of APC:
If the recovery message, GPS Interface Unit Recover is displayed for the control-side CPU module
immediately thereafter, the module is not faulty.
If the V net configuration is unstable:
In a condition where the V net is not connected correctly, such as at startup, a bus configuration error may
occur. In this case, the V net controller in CPU module cannot read time information and this message will
be notified as a result. Reconnect the bus correctly and start the SCS. If the message no longer appears,
the module is recovered.

l IRIG-B Time Synchronization
In the IRIG-B time synchronization, the time is acquired from the standard time receiver. The
IRIG-B time is used for time stamps of events and alarms set in the CPU. This method produces
more accurate timing for events among SCSs, if compared to the V net time synchronization
method. The time of the CPU module and DI modules are synchronized to the IRIG-B time.
V net
SCS Other SCSs
CPU
Standard
IRIG-B IRIG-B
time IRIG-B time IRIG-B time
receiver
Time setting
DI module
IRIG-B time
A030202E.ai
Figure Time Synchronization with IRIG-B Time Synchronization
l Synchronization with Vnet/IP Time

The structure of the synchronization with Vnet/IP time is shown below.
SENG HIS
Vnet/IP time Vnet/IP time
Time Time
master notification Time
notification
SCSP
Standard time
CPU
SNTP Vnet/IP Vnet/IP Vnet/IP
domain 1 domain 2 Vnet/IP time
server
Time
(Installed as necessary) notification
Time
notification SCSP SCSP
CPU CPU
Vnet/IP time Vnet/IP time
Time
setting
DI module
Vnet/IP time
A030203E.ai
Figure Time Synchronization with Vnet/IP Time

The SCS system time is synchronized with the Vnet/IP network time. When using the
synchronization with Vnet/IP time, all stations in the same time group on the Vnet/IP network
have the same time information as the clock master. If an SNTP server is installed, the SCS
system time is synchronized with the standard time of the SNTP server.
If the SCS system time is synchronized with the SNTP server time, any time change setting
from the SENG or HIS is ignored.
If the SNTP server is shut down or the SNTP server is not synchronized with the standard
time, the SCS system time is automatically synchronized with the clock master of the same
time group (synchronized with internal clock). Accuracy with the standard time drops, but
time accuracy between stations is maintained.
n Actions Taken at Error Occurrence in IRIG-B Time Synchronization

The IRIG-B time synchronization status can be checked in the SCS State Management Window
of the SCS Maintenance Support Tool on the SENG, or in the SCS Status Display view on the
HIS.
l Reasons for Time Synchronization Error

A time synchronization error occurs for the following reasons.
Disconnected IRIG-B cable connector
IRIG-B interface unit failure in the SCS
No time notification due to GPS receiver failure
TIP
Examples of GPS receiver failure are listed below.
Failure in the communication route from the GPS antenna to the GPS receiver
Antenna failure or receiving problem
What happens when the GPS receiver fails is determined by the specification of the selected GPS receiver. The
following is an example of what might happen when the GPS receiver fails.
Since GPS signals are no longer received, the GPS receiver operates based on its clock.
If reception problem continues more than a specified period, the GPS receiver stops operating on its clock
and also stops notifying time information to the connected devices.
Once time notification is stopped, the SCS outputs a diagnostic information message notifying an IRIG-B error.
l Notification of Time Synchronization Error

If the IRIG-B time synchronization state has become abnormal when the IRIG-B time
synchronization is selected, the SYNC LED on the SCSs CPU module turns off and
a diagnostic information message indicating an error is notified. If the SCS adopts a
redundant CPU module configuration, diagnostic information messages regarding both
modules are notified.
Once the IRIG-B time synchronization state returns to normal, a diagnostic information
message indicating a recovery is notified.

l SCS Actions Taken upon Time Synchronization Error
If time synchronization with IRIG-B stops, the SCS does not synchronize with the V net
time. Instead, the SCSs CPU module updates the time based on the time information input
immediately before the error. This condition is called non-synchronized state. The time is
updated continuously by the CPU module, but time accuracy still drops. Therefore, it is necessary
to recover the IRIG-B error to normal as soon as possible.
While the not-synchronized state continues, the SCS takes actions as follows.
In the not-synchronized state, the difference from the standard time and the time
discrepancy among SCSs gradually become larger as the time elapses. The difference
from the standard time can reach up to 4.32 seconds/day and the time discrepancy
among SCSs can reach up to 8.64 seconds/day. If the time discrepancy among SCSs
become larger, transmission delay timeout errors may occur in applications for inter-SCS
safety communication. When debugging applications that require high time precision, it is
recommended to connect a GPS simulator to prevent the system from entering the not-
synchronized state.
If the IRIG-B is not connected at the start of the SCS that uses the IRIG-B time
synchronization, the SCS enters a not-synchronized state where the CPU module updates
the time based on the V net time that was input when the SCS was started.
If the IRIG-B is not connected at the start of the SCS that uses the IRIG-B time
synchronization, a diagnostic information message notifying the cause of the last CPU
shutdown and a diagnostic information message regarding switching of CPU control right,
both of which are normally output when the SCS is started, will not be output.
Once the SCS has been started or CPU control right switched, however, subsequent
messages will be output correctly.
You can connect normal IRIG-B signals to recover from the error state while the SCS is in a
not-synchronized state. Once the signals are connected, the SCS will operate based on the
correct time information input from the IRIG-B.
IMPORTANT
If the IRIG-B time synchronization is selected, connect the GPS unit via the IRIG-B first, and then
start the SCS.
SEE
ALSO For details on the time synchronization, see the following:
2.14, Time Synchronization of the Engineering Guide (IM 32S01C10-21E)

<A4.1 Flow of Process Data Inputs and Outputs> A4-1
A4. Process Data Inputs and Outputs

Process data inputs and outputs of an SCS can be classified into two types, analog input/
output and discrete input/output.
This chapter explains the flow and processing of process data in an SCS, input/output
variables, and items that can be set for AIO/DIO modules, which act as interfaces for
input/output data.
n Types of Process Data Inputs and Outputs

SCS process data inputs and outputs are classified into the following two types:
Analog input/output
Discrete input/output
A4.1 Flow of Process Data Inputs and Outputs

This section explains the flow of process data in an SCS. It also explains the Output
Enable/Output Disable status of an SCS and the output enable operation.

n Flow of Process Data

The figure below illustrates the flow of SCS process data.
CPU
Application logic
Function Blocks
Input variable Output variable
Output
enable/disable
I/O Image Input data Status information Output data

Area
Legend
Input module Output module Data Value
Data Status
Sensor device Devices such as valves or lamps

A040101E.ai
Figure Flow of Process Data
1. Data sent from sensor devices or other sources is read from each channel of a connected
input module.
2. The CPU copies the data stored in the input module to the I/O image area at the start
of scanning. At this point, the data value and data status are determined based on the
information from the input module. If the input data is erroneous, the data status is set to
BAD and the data value is set to the Input value at error occurrence specified in I/O
Parameter Builder by the user.
tip
The following settings defined in I/O Parameter Builder are used for Input value at error occurrence, which is
used if input data is erroneous.
[Input Processing at Fault] of AI and DI modules
[Input Processing at Transmitter Fault] of an AI module
This manual uses the term input value at error occurrence in the following explanation as a generic term.
3. The CPU stores the input data in the I/O image area in the input variables of the application
logic. It also updates the data status of the output variables.
4. The application logic references the data value and data status from the input variables and
monitors the process conditions and input device status.
5. The result of the application logic processing is stored in the output variables and then sent
to the output module via the I/O image area.
6. The output module outputs the data to devices such as valves or lamps connected to each
of the channels.

l Data Value at AIO/DIO Module Dual-redundant Configuration
If dual-redundant input modules are used, the input values from the active module are stored
in the input variables. If dual-redundant output modules are used, the data values of the output
variables are sent to both active and standby modules, but the data is only output to the field
from the active module. In the case of SDV526, the data values are output to the field from both
modules.
l Conversion of Analog Input Data

Analog data of either 4 to 20 mA or 1 to 5 V/ 1 to 10 V is converted to data of 0 to 100% in the
CPU process data input processing and stored in the input variables. This means that the data
values stored in the input variables have been normalized to values between 0 and 100%.
All data that requires normalization, such as measurements from differential pressure
transmitters, is automatically processed in the process data input processing in this way.
Subsequent conversion from data in the range from 0 to 100% to data using engineering units
can be performed freely in the application logic.
l Flow of Analog Output Data

Data of 0 to 100% set in IO_REAL type output variables from the application logic are converted
to electrical current of 4 to 20 mA by each output module and output.
n Output Enable and Output Disable

Output channels of an SCS can be in the Output Enable and Output Disable states. The Output
Enable and Output Disable states are managed by each channel; the output states of all the
output channels of an SCS do not always match.
Output Enable is a status where the output values from the application logic are output from
the output module as is.
Output Disable is a status where the output values from the application logic are not output
from the output module.
l Output Enable Operation

Output enable operation means connecting outputs from the application logic to the output
channels. If you perform the output enable operation from the I/O Channels Status dialog box
of SCS Maintenance Support Tool on the SENG, all modules are placed in the Output Enable
status simultaneously (not individually). Once the output enable operation is performed, all output
channels are in the Output Enable status and output values of the application logic are output
from the output channels. Channels that continue to generate errors remain in the Output Disable
status. The following processing is also performed in the output enable operation implemented
immediately after an SCS is started:
Start sending data in inter-SCS safety communication
Start SCS Link Transmission
Start outputting data in subsystem communication
SEE
ALSO For more information about the output enable operation, see the following:
3.1.6, Output Enable Operation of the Utilities and Maintenance Reference (IM 32S04B20-21E)

<A4.2 Input and Output Variables> A4-4
A4.2 Input and Output Variables

This section explains the input and output variables, and their data value and the data
status.
n What are Input and Output Variables?

Input variable
input module
Physical data Logical data

Input data Input data Input data
Data status Data status Data status
Lock/unlock variable
Output variable
Logical data Physical data
Output module
Output data Output data Output data
Lock/unlock variable
A040201E.ai
Figure Input Variable and Output Variable
Variables that handle input values and output values of input/output modules are referred to as
input and output variables, respectively. Input and output variables contain two types of data,
logical data and physical data. When input and output variables are defined, both logical data
and physical data are automatically created.
Table Input Variable and Output Variable
Type Data Description
Physical data Data set from the I/O image area
Input variable
Logical data Data referenced by the application logic (*1)
Physical data Data set in the I/O image area (*2)
Output variable
Logical data Data set by the application logic
*1: If the input data is erroneous, the input value at error specified by the user in advance is set.
*2: This is the value set to the output module.

The application logic can basically handle logical data only. In the normal status, the same data is
stored in the logical data and physical data; the user does not need to be aware of the difference
between these two types of data. Note, however, that physical data needs to be referenced from
the SCS Manager window when locking input/output variables via the forcing function, or if both
data are not connected due to input/output module failures, etc.
Both the logical data and physical data are composed of data value and data status. In order to
handle data value and data status, input/output variables provide IO_BOOL type for handling
BOOL-type data and IO_REAL type for handling real number-type data, which can be used
according to the data type of the data value.
The data value and data status can be referenced using the application logic. Use the syntax
input/output variable name.v and input/output variable name.status in order to read only the
data value or the data status from an input/output variable, respectively.
SEE
ALSO For more information about the forcing function, see the following:
A8, Forcing
See the following for the detailed explanation about locking input/output variables:
A8.1, Variable Locking
l Data Status of Input/Output Variables

The data status of input/output variables is expressed as a BOOL value.
Table Data Status that can be Referenced by User Applications
BOOL
Status Meaning
value
Status where no error has occurred in input/output modules. In the case of an input
TRUE GOOD
variable, this means the data value is from the field.
This indicates a status where a normal data value cannot be obtained from or a value
cannot be set to an input/output module due to failure of an input module, etc. In the
FALSE BAD
case of an input variable, the data stored is the input value at error specified in I/O
Parameter Builder.
n Input/Output Variable Condition and Data Value/Data Status
l Timing at which Data Status is Created

The data status of the input/output variables is created based on the I/O status information. If the
input/output variables are not locked, the data statuses of the physical data and the logical data
are the same. If the input/output variables are locked, only the data status of the physical data is
updated.
In the case of an output variable, the update timing and transmission direction are different for
the data value and the data status. Moreover, in the Output Disable status, the data values of the
physical data and the logical data are different but the data status matches.
SEE
ALSO For more information about input/output variable lock operation, see the following:
2.1, I/O Lock Window of the Utilities and Maintenance Reference (IM 32S04B20-21E)
Lock/unlock status of input/output variables, Output Enable/Output Disable status and data
value/data status in each status can be summarized as shown in the following tables.

l Data Value and Data Status of Input Variables
Table Data Value and Data Status of Input Variables
Status Physical data Logical data
The data value matches with that of the
Unlocked status The data value takes the input value from an
physical data. The data status matches with
(at normal input) input module. The data status is GOOD.
that of the physical data.
The data value takes the input value from
Unlocked status The data value takes the input value at error
an input module. The previous value is
(at erroneous defined in I/O Parameter Builder. The data
maintained if there is no response. The data
input) status matches with that of the physical data.
status is BAD.
The data value and data status immediately
Same as for unlocked status for both the data
Locked status before locking are retained. They can be
value and data status
changed from the SCS Manager.
SEE
ALSO For details on how data values and statuses change upon occurrence of an input error, see the followings:
B6.2.1, Actions Taken at Input Module Error Occurrence and Recovery Procedure
B6.2.2, Actions Taken at Input Channel Error Occurrence and Recovery Procedure
l Data Value and Data Status of Output Variables

Table Data Value and Data Status of Output Variables
Status Physical data Logical data
The data value matches with that of the logical
Output
data. The status of the output module is
Enabled The data value is set to the result of
reflected in the data status at each interval.
Unlocked the application logic processing. The
status The data value becomes the fail-safe value data status matches with that of the
Output defined on I/O Parameter Builder. The status of physical data.
Disabled the output module is reflected in the data status
at each interval.
The data retains the value immediately before
Output locking and the value can be changed from the
Enabled SCS Manager. The status of the output module
is reflected in the data status at each interval. The data value is set to the result of
the application logic processing. The
Locked The data value retains the previous value. data status is retained immediately
status However, the fail-safe value is set by the CPU before locking and the status can be
Output when the output is disabled. (The value can be changed from the SCS Manager.
Disabled changed from the SCS Manager.) The status of
the output module is reflected in the data status
at each interval.
SEE
ALSO For more information about the output enable operation, see the following:
For details on how data values and statuses change upon occurrence of an output error, see the followings:
B6.2.3, Actions Taken at Output Module Error Occurrence and Recovery Procedure
B6.2.4, Actions Taken at Output Channel Error Occurrence and Recovery Procedure

l Logical Data and Physical Data of Analog Output
The relationship of logical data and physical data of analog output is shown below. Analog output
processing consists of discrete output operation, plus limiter processing and tight-shut/full-open
processing.
LD: Logical data

Locked/output
PD: Physical data enabled
PD.
Output disabled status
or locked
Value GOOD I/O

from Limiter Tight-shut/full-open Output
LD.v PD.v image module
application processing processing area
logic Unlocked/
output BAD
enabled
Output value
at fault
Forcing
A040102E.ai
Figure Flow of Logical Data and Physical Data of Analog Output
The following processing is performed until the logical data is output as physical data from the
analog output module.
Output is limited to a range of -17.19 to 118.75 [%].
If tight-shut/full-open is specified, the tight-shut value is set when the logical data is 0.0 or
below, or the full-open value is set when the data is 100.0 or above.
If output is disabled or locked, the last physical data value is retained.
If an error occurs, the output value at fault is set or the last value is retained in accordance
with the output processing at fault.
n Data Status at AIO/DIO Module Dual-redundant Configuration

In the case of dual-redundant input modules, the data status of each input variable is determined
based on the I/O status information of the active input module. The same rule applies to dual-
redundant output modules as well.

n Online Change Download of AIO/DIO Module Settings

When you perform online change download after you have made changes to the settings for AIO/
DIO modules using I/O Parameter Builder, downloading to the AIO/DIO modules (IOM download)
takes place depending on the setting items you have changed.
The behavior of SCS during online change download of setting items that require IOM download
differs between the SCS system program release number R2.02 or later and earlier revisions.
l R2.02 or later
The target AIO/DIO module continues its input/output operations during IOM download. The
behavior of SCS is as follows:
The target modules continue their input/output operations.
AIO/DIO modules in redundant configuration retain their control rights.
The diagnostic information message of IOM Fail is not output.
l Earlier than R2.02

The input/output operations of the target I/O module are all stopped during IOM download.
WARNING
If the system program release number of the target SCS is earlier than R2.02, the target AIO/DIO
modules will be stopped during IOM download even if the software release number of SENG is
R2.02 or later. In this case, a message indicating that the target AIO/DIO module will be stopped
(IOM Fail) is displayed before the online download is started.
You can confirm the system program release number of SCS in the SCS State Management
Window of the SCS maintenance support tool.
SEE
ALSO For the behavior of SCS with a system program earlier than R2.02, see the following:
9.6.2 Compatibility with Earlier Revisions of the Installation (IM 32S01C50-21E)
SEE
ALSO For the behavior of SCS with Modbus slave connection, see the following:
B1.1 Overview of Modbus Slave Connection of the Open Interface (IM 32S05B10-21E)
For the behavior of SCS in Subsystem communication, see the following:
C1.7 On-line Change of the Open Interface (IM 32S05B10-21E)

n Online Change of Input/Output Modules

From the SCS system program release number R2.03, addition, deletion, and change of
redundant configuration of input/output modules can be performed via online change download.
If input/output modules are added via online change download, diagnostic information messages
are issued to notify failure of input/output modules (No. 0081) and recovery of input/output
modules (No. 0082).
SEE
ALSO For more information about how to change application online, see the following:
5, On-line Change of Applications of the Engineering Guide (IM 32S01C10-21E)
For more information about input/output values when serial communication modules for sub-system
communication are added via online change download, see the following:
C1.3, Error Handling Actions of the Open Interfaces (IM 32S05B10-21E)

<A4.3 Common Setting Items for Process Data Inputs and Outputs> A4-10
A4.3 Common Setting Items for Process Data

Inputs and Outputs
Some of the settings for process data inputs and outputs of an SCS are common for all
input/output types, and some are specific to each input/output type.
This section explains setting items for nodes and common setting items for input/output
modules that are common for all process data inputs and outputs.
n Setting Items for Nodes

The following items are parameters for nodes; they are set in the [Node] tab of I/O Parameter
Builder.
Node number
Extends Node Bus
Extends To (Km)
Component number
Comment
Each node setting item is explained in detail below.
l Node Number
This item displays the node number in which a module is mounted. It is defined in I/O Wiring View
of SCS Manager.
This item is only for display and cannot be edited in the tab.
l Component Number
This is a comment related to node layout information. Any character string can be entered.
This setting item is not downloaded to an SCS.
This setting item can be changed online.
l Extends Node Bus : SCSP2

Select this option to specify whether or not to extend nodes by optical ESB bus repeater. For
every remote nodes installed via optical ESB bus repeater, select [Yes] and specify the distance
in [Extends To (Km)]. If you do not make this setting, the data from the nodes and SOE data will
not be updated correctly. If [Yes] is set for this item on CPU nodes, a build error will occur.
- Yes: Node extension by optical ESB bus repeater is applied.
- No: Node extension by optical ESB bus repeater is not applied. (default)
l Extends To (Km) : SCSP2

Use this item to specify the distance from a CPU node to an I/O node. It is only valid if [Yes] is
selected in the specification of node extension distance [Extends Node Bus].
- Range: 5 to 50 km (default: 5 km)
- Setting unit: 5 km

l Extends Node Bus : SCSP1
Select this option to specify whether or not to extend nodes by optical ESB bus repeater. To
extend nodes, select [Yes] and specify the distance in [Extends To (Km)]. A build error will occur if
you select [Yes] for this item when [Optical ESB Bus Repeater] on the SCS Constants Builder is
set to [No]. A build error will also occur if [Yes] is set for this item on CPU nodes.
- Yes: Node extension by optical ESB bus repeater is applied
- No: Node extension by optical ESB bus repeater is not applied (default)
TIP
In the case of nodes equipped with ALR111 or ALR121 for Modbus slaves, if 10 km or longer is specified in
[Maximum Extension Distance] on the SCS Constants Builder, select [Yes] and specify the node extension
distance in [Extends To (Km)].
l Extends To (Km) : SCSP1

Use this item to specify the distance from a CPU node to an I/O node. It is only valid if [Yes] is
selected in the specification of node extension distance [Extends Node Bus].
A build error will occur if the node extension distance is longer than [Maximum Extension
Distance] defined on the SCS Constants Builder.
If default (0) is specified, it is regarded as if the node is at the position specified by [Maximum
Extension Distance] defined on the SCS Constants Builder.
- Range: 0 to 50 km (default: 0)
- Setting unit: 5 km
IMPORTANT
Be sure to specify the extension distance according to the actual node extension distance. If no
specification is made for SCSP1, load fluctuation of CPU becomes large if input/output modules
and/or bus fail.
l Comment
This is a comment related to the node. Any character string of up to 24 single-byte characters or
12 double-byte characters can be entered.
This setting item is downloaded to an SCS.
This setting item can be changed via online change download.
SEE
ALSO For more information about node setting operation, see the following:
4.4, I/O Parameter Builder of the Engineering Reference (IM 32S04B10-21E)

n Common Setting Items for Input/Output Modules

The following setting items are common for each input/output module parameter tab of I/O
Parameter Builder.
Node Number: Display Only
Slot Number: Display Only
Device: Display Only
Dual-Redundant: Display Only
Device Number: Display Only
Comment
Each of the settings common to the input/output modules is explained in detail below.
l Node Number
This item displays the node number in which the input/output module is mounted. It is defined in
I/O Wiring View of SCS Manager.
l Slot Number
This item displays the slot number in which the input/output module is mounted. It is defined in
I/O Wiring View of SCS Manager.
l Device
This item displays the model name of the input/output module. It is defined in I/O Wiring View of
SCS Manager.
l Dual-Redundant
This item displays whether the input/output module is placed in single configuration or redundant
configuration. It is defined in I/O Wiring View of SCS Manager. Input/output modules are placed
in redundant configuration using an odd-numbered slot and the adjacent even-numbered slot
(the odd number + 1).
l Device Number
This is the device number assigned to the input/output module. It is defined in I/O Wiring View of
SCS Manager.
l Comment
This is a comment related to the input/output module. Any character string of up to 24 single-byte
characters or 12 double-byte characters can be entered.
This setting item is not downloaded to an SCS, so changing the definition does not affect input/
output processing.
This item can be changed online.

n Common Parameters for Input/Output Channels

The following items are displayed commonly for all AIO/DIO modules with channel parameters in
I/O Parameter Builder.
l Channel Number
This is the channel number displayed in I/O Wiring View of SCS Manager. It is sequential number
starting from 1.
This item is only for display and cannot be edited.
l Wiring Position
This is the channel position displayed in I/O Wiring View of SCS Manager. It is determined by
device number and channel identification number. The channel identification number used for
wiring position is sequential number starting from 0. The wiring position of the input modules is
prefixed with %IU while the wiring position of the output modules is prefixed with %QU.
Example: In the case of a 16-channel input module: %IU1.0, %IU1.1, ... %IU1.14, %IU1.15
In the case of a 8-channel output module: %QU3.0, %QU3.1, ... %QU3.6, %QU3.7
l I/O Variable Name

This is the name of input/output variables assigned to the channel in I/O Wiring View of SCS
Manager.
l Direction
This item indicates whether a signal is an input or output signal.
l Comment
This is a comment for an input/output variable specified in Dictionary View (*1) of SCS Manager.
*1: The comment for the input/output variable specified in Dictionary View of SCS Manager is displayed as the comment for the
wired channel. Up to 64 characters can be specified for the variable comment, but only 32 characters are retained in SCS
database; therefore, make sure not to specify more than 32 characters. Channel comments for unused channels (unconnected
channels) are not displayed.
Comments for DI/DO variables are the variables used as identifiers of SOE.
TIP
If comments for DI/DO variables are changed in Dictionary View of SCS Manager, discrepancies occur due to the
input/output definition changes, and it becomes necessary to perform online change download to the SCS. Since
this changes only the definitions in the databases of the SCS (no changes are made to the parameters of the
DI/DO modules themselves), the inputs and outputs are not influenced by the online change download.

<A4.4 Items Set for Analog Inputs> A4-14
A4.4 Items Set for Analog Inputs

Different items are specified depending on the type of input/output modules of SCS.
This section explains setting items unique to analog inputs, classifying them into setting
items for each module and each channel in I/O Parameter Builder.
n Items Set for Each Module (Analog Input)

The following items are set for each analog input module:
Node number: Display only
Slot number: Display only
Device: Display only
Dual-Redundant: Display only
Device Number: Display only
Comment
Command Line
SEE
ALSO For more information about common setting items for process data inputs and outputs, see the following:
A4.3, Common Setting Items for Process Data Inputs and Outputs
The setting items that are not explained above as common items are explained below.
l Command Line
This item does not need to be entered.

n Items Set for Each Channel (Analog Input)

The following items are set for each channel of an analog input module:
Online change IOM download
Setting items Remarks
download (*1) (*2)
Channel Number - - Only for display
Wiring Position - - Only for display
I/O Variable Name - - Only for display
Direction - - Only for display
Comment - - Only for display
Input Processing at Fault Available -
Input Value at Fault Available -
Input Processing at Transmitter Fault Available -
Signal Conversion Available -
High Limit Available Yes
Low Limit Available Yes
Unit - - Only for display
Detect IOP (High) Available -
Detect IOP (Low) Available -
Threshold of IOP (High) % Available -
Threshold of IOP (Low) % Available -
Detect Transmitter Fault (High) Available -
Detect Transmitter Fault (Low) Available -
Threshold of Transmitter Fault (High) % Available -
Threshold of Transmitter Fault (Low) % Available -
Field Power Diagnosis Available Yes
P&ID Tag Name Available -
*1: Indicates whether the setting can be changed by online change downloading.
Available: The setting can be changed by online change downloading.
-: Online change downloading is not required.
*2: Indicates whether the IOM downloading is performed with the online change downloading.
Yes: The IOM downloading is performed together with the online change downloading.
-: The IOM downloading is not performed together with the online change downloading.
SEE

l Input Processing at Fault

This item specifies an input processing to be used when an input fault is detected or when [Input
Processing at Fault] is selected in [Input Processing at Transmitter Fault].
Specify either [Hold] or [Fixed Value].
The input faults that can be detected include errors on both redundant communication paths from
the CPU to an analog input module, errors in analog input modules, channel errors, IOP and field
wiring errors (transmitter errors are not included).
Hold:
The value before the fault was detected is retained.
Fixed Value:
The input value specified in [Input Value at Fault] is set (default).
l Input Value at Fault

This is the value set as the input value instead of the process value if [Fixed Value] is selected in
[Input Processing at Fault] (the value used as an input value at error).
Specify the input value at error (%) in the range from -25.0 to 125.0. The default value is 0.0%.
This item is valid only when [Input Processing at Fault] is [Fixed Value].
Even if the [Signal Conversion] is set to SQRT, this setting value is used directly as the input
value when error occurs. (The value set here will not be square-rooted when used as the input
value.)
l Input Processing at Transmitter Fault

This is the value set as the input value if a transmitter error is detected (a value used as an input
value at error). This item is valid for current inputs.
Input Processing at Fault:
Follow the setting of [Input Processing at Fault] if a transmitter error occurs (default).
Raw Data:
The raw data from the input module is set as the input value.

l Signal Conversion
This item specifies the conversion method of the input signal.
LINEAR (No Conversion):
The physical range specified by the [Low Limit] and [High Limit] (mA or V) is converted to 0
to 100 (%) data (default).
SQRT:
After LINEAR conversion, input range checks are performed (against the IOP high limit/low
limit and transmitter fault high limit/low limit). Then, the square root is calculated and the
result is converted to a data value of 0 to 100 (%).
The square-root conversion is illustrated as follows:
Input signal
(converted value)
100%
SL : [Lower Limit] (4 mA for current input)

SH: [High Limit] (20 mA for current input)
0%
SL SH Input signal
(raw data)
A040401E.ai
Figure SQRT
l High Limit/Low Limit

These items refer to the upper limit value and lower limit value of the input signal from the field.
Values between 0 and 100% are assigned to the specified measurement range. The
measurement range can only be changed for voltage input modules.
Table High Limit Value/Low Limit Value
Input module Low limit value High limit value
Input type
model name of range of range
Current input SAI143 4 20
1.000 to 10.000 1.000 to 10.000
Voltage input SAV144
(default is 1) (default is 5)
l Unit
This is the unit of the input signal and determined by the type of input module.

l Detect IOP (High)
This item specifies whether to detect an input open status when the process value (the value
after the input signal was converted (0 to 100%)) exceeds the threshold. When the signal
conversion setting is [SQRT], the value before square-root calculation is used as the process
value (hereinafter referred to as process value).
No:
An input open circuit error is not detected.
Yes:
If a process value exceeds the threshold value, an input open circuit error is detected and
the data status of the input variable connected to the applicable channel becomes BAD.
(default). The threshold value is specified with [Threshold of IOP (High) %].
l Detect IOP (Low)

This item specifies whether or not to detect an input open circuit error if a process value falls
below the threshold value.
No:
An input open circuit error is not detected.
Yes:
If a process value falls below the threshold value, an input open circuit error is detected and
the data status of the input variable connected to the applicable channel becomes BAD.
(default). The threshold value is specified with [Threshold of IOP (Low) %].
l Threshold of IOP (High) %

This item specifies the upper limit level at which an input open circuit error is detected. This
item is only enabled when [Yes] is specified for [Detect IOP (High)]. An input open circuit error is
judged if the process value exceeds this setting.
The default value is 112.5% (for current input) and 106.3% (for voltage input).
Note that the following checks are performed even if [No] is specified for [Detect IOP (High) ].
An error occurs if a value is entered such that the value of [Threshold of IOP (High) %]
becomes equal to or smaller than the value of [Threshold of Transmitter Fault (High) %].
An error occurs if a value outside the range with guaranteed accuracy of input module.
(Accuracy guarantee range)
Current input: -18.75% to 118.75% (1 to 23 mA)
Voltage input: Varies depending on the range specification (0.1 to 11 V)
If the range is set to 1 to 10 V: -10% to 111.1%
If the range is set to 1 to 5 V: -22.5% to 125%
In addition to the checks above, the following input checks are performed.
Number of input characters: Up to 7 single-byte characters
Number of decimal places: Up to 2 digits

l Threshold of IOP (Low) %
This item specifies the lower limit level at which an input open circuit error is detected. This item is
enabled only when [Yes] is specified for [Detect IOP (Low) ]. An input open circuit error is judged
if the process value falls below this setting.
Specify a value between -25.0% to 125.0%. The default value is -6.3%.
Note that the following checks are performed even if [No] is specified for [Detect IOP (Low) ].
An error occurs if a value is entered such that the value of [Threshold of IOP (Low) %]
becomes equal to or greater than the value of [Threshold of Transmitter IOP (Low) %].
An error occurs if a value outside the range with guaranteed accuracy of the analog input
module.
Voltage input: Varies depending on the range specification (0.1 to 11 V)
If the range is set to 1 to 10 V: -10% to 111.1%
If the range is set to 1 to 5 V: -22.5% to 125%
In addition to the checks above, the following input checks are performed.
Number of input characters: Up to 7 single-byte characters
l Detect Transmitter Fault (High)

This item specifies whether or not to detect a transmitter error if a process value exceeds the
threshold value. This item is only enabled for current inputs.
No:
A transmitter error is not detected.
Yes:
If the process value exceeds the threshold value, a transmitter error is detected and the data
status of the input variable connected to the applicable channel becomes BAD. (default).
The threshold value is specified with [Threshold of Transmitter Fault (High) %].
l Detect Transmitter Fault (Low)

This item specifies whether or not to detect a transmitter error if a process value falls below the
threshold value. This item is enabled only for current inputs.
No:
A transmitter error is not detected.
Yes:
If the process value falls below the threshold value, a transmitter error is detected and
the data status of the input variable connected to the applicable channel becomes BAD
(default). The threshold value is specified with [Threshold of Transmitter Fault (Low) %].

l Threshold of Transmitter Fault (High) %
This item specifies the upper limit level at which a transmitter error is detected. This item is
enabled only when [Yes] is specified for [Detect Transmitter Fault (High) ]. A transmitter error is
judged if the process value exceeds this setting. This item is only enabled for current inputs.
The default value is 106.3%.
Note that the following checks are performed even if [No] is specified for [Detect Transmitter Fault
(High) ].
An error occurs if a value is entered such that the value of [Threshold of IOP (High) %]
becomes equal to or smaller than the value of [Threshold of Transmitter Fault (High) %].
An error occurs in I/O Parameter Builder if a value outside the range with guaranteed
accuracy of the analog input module.
l Threshold of Transmitter Fault (Low) %

This item specifies the lower limit level at which a transmitter error is detected. This item is
enabled only when [Yes] is specified for [Detect Transmitter Fault (Low) ]. A transmitter error is
judged if the process value falls below this setting. This item is only enabled for current inputs.
The default value is -1.25%.
Note that the following checks are performed even if [No] is specified for [Detect Transmitter Fault
(Low)].
An error occurs if a value is entered such that the value of [Threshold of IOP (Low) %] level
becomes equal to or greater than the value of [Threshold of Transmitter Fault (Low) %].
An error occurs if a value outside the range with guaranteed accuracy of the analog input
module.

TIP
If it is specified to detect input open (IOP+, IOP-) and transmitter errors (TRNS+, TRNS-), diagnostic information
messages indicating the occurrence of an alarm and the recovery are notified as follows:
If the PV value changes, causing the alarm status to change, a diagnostic information message
corresponding to the status after change is notified.
The diagnostic information message indicating recovery from the generated alarm is notified only when
the alarm status recovers to NR (normal). Messages indicating recovery from individual alarms, IOP+/IOP-
/TRNS+/TRNS-, are not notified.
Following (1) to (7) are the Diagnostic information messages that are notified at the change of the PV value:
PV
IOP+
IOP upper limit detection level

TRNS+
Transmitter error upper limit detection level
(2) (3)
(1) (4) (5) (6)
NR
Transmitter error lower limit detection level
TRNS-
IOP lower limit detection level
IOP-
(7)
PV value before change

PV value after change
(1) Occurrence of TRNS+
(2) Occurrence of IOP+ (No messages indicating recovery from TRNS+ are generated.)
(3) Occurrence of TRNS+ (No messages indicating recovery from IOP+ are generated.)
(4) Recovery from channel error
(5) Occurrence of IOP+ (No messages indicating occurrence of/recovery from TRNS+ are generated.)
(6) Recovery from channel error
(7) Occurrence of IOP+ (No messages indicating recovery from IOP- are generated.
No messages indicating occurrence of/recovery from TRNS- are generated.
No messages indicating occurrence of/recovery from TRNS+ are generated.)
A040402E.ai
Figure Generation of Diagnostic Information Messages

l Field Power Diagnosis
This item specifies the wiring type as 2-wire or 4-wire. It is used to determine the method of
power supply diagnosis of the input modules. Current input modules perform self-diagnosis on
whether or not the power is supplied correctly to the field according to this setting. This item is
only enabled for current inputs.
IMPORTANT
Make sure that this setting matches with the 2-wire/4-wire setting made using the setting pins
in the analog input module. If the settings made here are different from those of the hardware, a
channel error occurs in the case of single input module configuration and the control shifts to the
standby module in the case of a dual-redundant input module configuration.
None: Do not perform field power supply diagnosis.

2 wire:
2-wire (Default: Diagnose that the power is supplied to the field. Diagnosis indicates
normal if the power is supplied to the field device.)
4 wire:
4-wire (Diagnose that no power is supplied to the field. Diagnosis indicates normal if no
power is supplied to the field device.)
l P&ID Tag Name

This is a comment that the user can specify in order to make it easy to identify information drawn
on a P&ID drawing with the channel.
The comment should be written using up to 16 single-byte characters or 8 double-byte
characters. This setting item can be omitted.

<A4.5 Items Set for Analog Outputs> A4-23
A4.5 Items Set for Analog Outputs

This section explains I/O Parameter Builder setting items unique to analog outputs,
classifying them into setting items for each module and each channel.
n Item Set for Each Module (Analog Outputs)

The following item is set for each analog output module:
Command Line
SEE
The setting item that is not explained above as common item is explained below.
Command Line
TIP
Specify the command line using up to 256 single-byte characters. If the command line is not set, the default value
will be used for each applicable item. The format is as follows.
Item name = Data value, Item name = Data value,
SOOP (Output open detection level)

This item specifies an output open (OOP) detection level. An open circuit error is recognized
when the readback value of an output falls below the set value. The default is 0.00085 A.
Format
SOOP=0.001
Parameter
- Output open detection level
Specify an output open detection level in amperes (A). The specifiable range is 0 to
0.023 A. The following condition must be satisfied.
SOOP < Output value at fault (fail-safe value)
Tight-shut output is specified: SOOP < Tight-shut output value
Tight-shut output is not specified: SOOP < Power-on output value (0.00125 A)
- This item can be changed via online change download. Note, however, that IOM
download is also performed at the same time.

n Items Set for Each Channel (Analog Output)

The following items are set for each channel of an analog output module:
download (*1) (*2)
Output Shutoff Switch Available Yes
Output Processing at Fault Available Yes
Output Value at Fault Available Yes
Tight-shut/Full-open Available Yes (*3)
Tight-shut Value Available Yes
Full-open Value Available -
Detect Short Circuit Available Yes
Detect Disconnection Available Yes
Command Line Available Yes
*3: IOM downloading may be performed according to the modified contents.
SEE
Output Shutoff Switch

The output shutoff switch can be used to shutoff all the outputs of the module when the module
encounters a critical malfunction for properly outputting signals, and the whole module becomes
failure mode (Module HRDY OFF).
Enable or disable this switch needs to be specified.
Enable:
Activate the Output Shutoff switch if a dangerous failure occurs (default).
Disable:
Do not activate the Output Shutoff switch even if a dangerous failure occurs.

Output Processing at Fault
This item needs to be specified so that when an error occurs in CPU module (both CPU modules
in redundant configuration) or in the path from CPU to output module, the output module can act
the specified processing for the output from the output channel to the field device.
Hold:
Hold the outputs upon detection of an error.
Fixed Value:
Change each output value to the value specified in [Output Value at Fault] upon detection of
an error (default).
Output Value at Fault

This value is used as a fail-safe value (i.e., output value at fault) when [Output Processing at
Fault] is set to [Fixed Value].
Specify the value to be output upon error, in a range of -17.19 to 117.19 (%). The default
is -17.19%. This setting is effective only when [Output Processing at Fault] is set to [Fixed
Value].
The following input checks are performed.
Range: -17.19 to 117.19 (%)
Permitted characters: Single-byte numbers, decimal point, negative sign (-)
Number of characters: Up to 6 single-byte characters
Tight-shut/Full-open
Tight-shut/full-open is a function that reduces the actual output value to 0% or below when the
manipulated output value is 0%, or increases the actual output value to 100% or above when the
manipulated output value is 100%, in order to fully close or open the control valve firmly. Specify
whether or not to enable this function.
If PRM is used, set [Tight-shut/Full-open] to [Yes] and determine an appropriate tight-shut value
for the connected device.
Yes:
Enable the tight-shut/full-open function (default). Specify a tight-shut value in [Tight-shut
Value], and a full-open value in [Full-open Value].
The initial output value of the module (i.e., default initial value upon power-on) will be the
same value of the tight-shut output.
No:
Disable the tight-shut/full-open function. The initial output value of the module (default initial
value upon power-on) is fixed to -17.19% (1.25 mA).

The graphs below show the relationships of logical data (LD) and physical data (PD) when the
data is normal, output is enabled, and output variable is not locked.
<Relationship of LD and PD with tight-shut specification> <Relationship of LD and PD without tight-shut specification>
PD.v[%] Full-open output value PD.v[%] Full-open output value

(default: 106.25%) (default: 106.25%)
118.75
106.25 106.25
100.0 100.0
0.0 -17.19 0.0

100.0 117.19 LD.v[%] 100.0 118.75 LD.v[%]
Tight-shut output value
(default: -17.19%)
-17.19 -17.19
A040501E.ai
Tight-shut Value
This item specifies in a range of -17.19 to 0 (%) the actual value to be output when the tight-shut/
full-open function is specified and the output value is 0%. The default is -17.19% (1.25 mA).
This setting is possible only when [Tight-shut/Full-open] is set to [Yes].
Range: -17.19 to 0 (%)
Full-open Value
This item specifies in a range of 100 to 117.19 (%) the actual value to be output when the tight-
shut/full-open function is specified and the output value is 100%. The default is 106.25% (21 mA).
This setting is possible only when [Tight-shut/Full-open] is set to [Yes]. To implement reverse
output, create the necessary application using the application logic.
Range: 100 to 117.19 (%)

Detect Short Circuit
This item specifies whether or not to detect short circuit.
Yes:
Detect short circuit (default).
No:
Do not detect short circuit.
Detect Disconnection
This item specifies whether or not to detect open circuit.
Yes:
Detect open circuit (default).
No:
Do not detect open circuit.
P&ID Tag Name


Command Line
SCREG (Short circuit detection level)
This item specifies a short circuit detection level. A short circuit is detected when the wiring
resistance falls below the set value. By specifying a value greater than the wiring resistance
as the short circuit detection level, it is possible to detect short circuit of device terminals.
The default is 70 .
Format
SCREG=100
Parameter
- Short circuit detection level
Specify a short circuit detection level in ohms (). The specifiable range is 60 to 750 ,
and the value must be an integer. The short circuit detection level must also satisfy the
following condition.
SCREG (Specified short circuit detection level) > Wiring resistance (*1)
*1: Add the resistances of KS cables, etc. to the wiring resistance.
IMPORTANT
If the current output value falls below -6.25% (3 mA) due to the settings of [Output Value at Fault]
and [Tight-shut Value], the short circuit detection operation becomes unstable in the range of
SCREG setting 20 ohms.
Therefore, consider the above characteristics and actual wiring resistance and set an appropriate
SCREG value that allows short circuit detection to be performed without fail.
If the default SCREG setting (70) is used without setting the command line, short circuit is not
detected if the wiring resistance reaches or exceeds 90 . However, short circuit is detected
without fail when the wiring resistance is 50 or below.
(Example) A device is connected using a KS cable and the short circuit detection level is set
to 70
Terminal Output
Device
block module
Wiring KS cable
A040502E.ai
- Add the resistance of KS cable to the wiring resistance.

- If the short circuit detection level is set to 70 , the following operations are performed in
accordance with the output current value.
3 mA (-6.25%) or above: Short circuit is detected without fail at 60 or below.
Short circuit is never detected at 80 or above.
(Error: 10 )
1 mA (-18.75%) or above, but below 3 mA:
Short circuit is detected without fail at 50 or below.
Short circuit is never detected at 90 or above.
(Error: 20 )
Below 1 mA: Short circuit is never detected.
TIP
(Reference)
The resistance values of respective cables are as follows:
KS cable: 230 /km
Standard cables (AWG20, etc.): 23 to 50 /km

<A4.6 Items Set for Discrete Inputs> A4-29
A4.6 Items Set for Discrete Inputs

Different items are specified depending on the type of inputs and outputs when setting
process data inputs and outputs of an SCS.
This section explains setting items unique to discrete inputs, classifying them into setting
items for each module and each channel.
n Items Set for Each Module (Discrete Input)

The following items are set for each DI module in I/O Parameter Builder.
download (*1) (*2)
Node Number - - Only for display
Slot Number - - Only for display
Device - - Only for display
Dual-Redundant - - Only for display
Device Number - - Only for display
Software Filter Available Yes
Automatically Delete Noisy Events Available Yes
SOE Deletion Schedule Available Yes
Number of SOE Events Available Yes
SEE
Each of setting items that are not explained as common items is explained below.
l Software Filter
The software filter is applied for reducing the influence of noises. An integer between 0 and 10
can be selected as the filter setting value. The default setting is 1.
With this filter, the discrete input chattering signals can be sifted out so as to prevent from error
actions.
The filter setting value multiplied by 10 ms (sampling period) is the filter time. The chattering
signals occurred within this filter time will be eliminated.
As an example, if the filter setting value is 2, the chattering signals shorter than 20 ms (2x10 ms)
will be eliminated.
If the filter setting value is 0, the noise signals will not be filtered thus PV varies with the
noise signals. In general, the filter setting value should not be set to 0.

l Automatically Delete Noisy Events
This item specifies whether or not to delete events automatically, if many events that are targets
of SOER occur.
If a channel repeatedly generates too many events, the events from other channels may be
lost. With this option, the number of repeated events per channel can be limited. If the number
of events that have occurred during the time specified in [SOE Deletion Schedule] exceeds the
number of events specified in [Number of SOE Events], all subsequent events will be discarded.
If [SOE Deletion Schedule] is set to 1 second and [Number of SOE Events] is set to 3, and three
or more events have occurred within 1 second, then the fourth and subsequent events occurring
within 1 second will be automatically discarded. However, if the last event is contradictory with
the current status of the DI, a pseudo event will be generated to indicate the DI status.
Yes: Automatically delete events if many events occur.
No: Do not delete events even if many events occur (default).
l SOE Deletion Schedule

This item specifies the time period setting for [Automatically Delete Noisy Events] in units of
seconds. This setting item is enabled if [Yes] is selected for [Automatically Delete Noisy Events].
Select either 0.5, 1.0, 1.5, 2.0, 2.5, 3.0 or 3.5 seconds. The default value is 1.0 second.
l Number of SOE Events

This item specifies the number of events for [Automatically Delete Noisy Events]. This setting
item is enabled if [Yes] is selected for [Automatically Delete Noisy Events].
Select either 3 or 5. The default value is 3 events.
SEE
ALSO For more information about SOE, see the following:
A7, SOER

n Items Set for Each Channel (Discrete Input)

The following items are set for each channel in I/O Parameter Builder for DI modules.
download (*1) (*2)
Input Processing at Fault Available -
Detect Short Circuit Available Yes
Pulse Test Available Yes
SOER (Setting for SOER) Available Yes
Trip Signal (Setting for SOER) Available -
SEE
ALSO For more information about items set commonly for process data inputs and outputs, see the following:

l Input Processing at Fault

This item specifies a value that will be passed to the application logic instead of the input from the
field if an error is detected in the input of the channel, including channel errors, DI module errors
and errors in the path from the CPU to the DI module.
0: The input value is set to 0 at error detection (default).
1: The input value is set to 1 at error detection.
Hold: The value immediately before the error was detected is retained when an error
is detected.
l Detect Disconnection (Open Circuit)

This item specifies whether or not to detect disconnection in the wiring.
Yes: Detect disconnection.
No: Do not detect disconnection (default). When the disconnection occurs, input
value is 0 and the status is GOOD.
IMPORTANT
If [Yes] is set for [Detect Disconnection], disconnection errors can be detected. Make sure,
however, to connect a wiring check adapter (SCB100) on the channel if you specify [Yes]. If you
specify [Yes] without connecting the adapter, the SCS erroneously detects a disconnection error
whenever the input value is OFF.
l Detect Short Circuit

This item specifies whether or not to detect short circuit in the wiring.
Yes: Detect short circuit (default).
No: Do not detect short circuit. When the short-circuit error occurs, input value is 1
and the status is GOOD.
IMPORTANT
If [Yes] is set for [Detect Short Circuit], short-circuit errors can be detected (assuming short circuit
with the power supply line). Make sure, however, to connect a wiring check adapter (SCB110)
on the channel if you specify [Yes]. If you specify [Yes] without connecting the adapter, the SCS
erroneously detects a short-circuit error whenever the input value is ON.

l Pulse Test
This item specifies whether or not to perform a pulse test (wiring check between the input
channels using pulse output).
Yes: Perform a pulse test (default).
No: Do not perform a pulse test.
IMPORTANT
If [Yes] is set for [Pulse Test], wiring short-circuit errors between input channels can be detected.
Make sure, however, to connect a wiring check adapter (SCB110) to the channel if you specify
[Yes] for a channel whose input signal is normally ON. If you specify [Yes] without connecting the
adapter, the SCS cannot detect inter-channel short circuit when the input value is ON.
l SOER (Setting for SOER)

This item specifies whether or not to accumulate events for SOER when the signal changes.
Yes: Accumulate SOE events when a signal changes (default).
No: Do not accumulate SOE events.
l Trip Signal (Setting for SOER)

This item specifies whether or not to regard the change in the channel signal as a trip occurrence.
This setting is only enabled if [Yes] is set for [SOER].
No (0): Changes are not regarded as a trip signal (default).
OFF TRIP (1):
A change to OFF is regarded as a trip signal and SOE data before and after a trip is stored
in the SCS.
ON TRIP (2):
A change to ON is regarded as a trip signal and SOE data before and after a trip is stored in
the SCS.
l P&ID Tag Name


<A4.7 Items Set for Discrete Outputs> A4-34
A4.7 Items Set for Discrete Outputs

Different items are specified depending on the type of inputs and outputs when setting
process data inputs and outputs of an SCS.
This section explains setting items unique to discrete outputs, classifying them into
setting items for each module and each channel.
n Items Set for Each Module (Discrete Output)

There is no item set for each module that is unique to discrete outputs (i.e., it is only necessary to
set common specification items for an IOM).
n Items Set for Each Channel (Discrete Output)

The following items are set for each channel in I/O Parameter Builder for DO modules.
download (*1) (*2)
Output Shutoff Switch Available Yes
Output Value in Detecting Error Available Yes
Pulse Test (OFF) Available Yes
Pulse Test (ON) Available Yes
SOER (Setting for SOER) Available -
Trip Signal (Setting for SOER) Available -
Command Line - - (*3)
*3: This item does not need to be entered.
SEE
ALSO For more information about items set commonly for process data inputs and outputs, see the following:

l Output Shutoff Switch

The output shutoff switch can be used to shutoff all the outputs of the module when the module
encounters a critical malfunction such as the output is clutched to ON status, and the whole
module becomes failure mode (Module HRDY OFF). If the Output Shutoff switch is activated, the
output of all DO channels of the relevant module is set to OFF. This setting is not affected in the
event of short circuit. For SDV526, this setting is fixed at Disable and cannot be changed.
Enable:
Activate the Output Shutoff switch if a dangerous failure such as the output getting stuck in
the ON status occurs (default).
Disable:
Do not activate the Output Shutoff switch even if a dangerous failure occurs.
l Output Value in Detecting Error

This item specifies a value output from the channel to the field if an error occurs on the CPU
module (both CPU modules in redundant configuration) or in the path from CPU to output
module. This definition is used as the fail-safe value set for the output variables. For SDV526, this
setting is fixed at the default value and cannot be changed.
0: Output 0 to the field at error detection (default)
1: Output 1 to the field at error detection
Hold: The value immediately before the error was detected is maintained when an error
is detected.
l Detect Disconnection (Open Circuit Detection)

This item specifies whether or not to detect disconnection.
Yes: Detect disconnection (default).
No: Do not detect disconnection.
l Pulse Test (OFF)

This item specifies whether to perform the off-edge pulse test so as to use the off-edge pulse to
test the wiring of the channel that maybe clutched to ON status (when the contact is clutched ON
or short-circuits occurred among channels). For SDV526, this setting is fixed at No and cannot be
changed.
Yes: Perform the off-edge pulse test (default).
No: Do not perform the pulse test.
l Pulse Test (ON)

This item specifies whether to perform the on-edge pulse test so as to use the on-edge pulse to
test the wiring of the channel that maybe clutched to OFF status (when the contact is clutched
OFF or short-circuits occurred among channels). For SDV526, this setting is fixed at No and
cannot be changed.
Yes: Perform the on-edge pulse test.
No: Do not perform the pulse test (default).

l SOER (Setting for SOER)
This item specifies whether or not to accumulate events for SOER when a signal changes.
Yes: Accumulate SOE events when a signal changes.
No: Do not accumulate SOE events (default).
l Trip Signal (Setting for SOER)

This item specifies whether or not to regard an event as a trip occurrence. This setting is only
enabled if [Yes] is set for [SOER].
No (0): Changes are not regarded as a trip signal (default).
OFF TRIP (1):
A change to OFF is regarded as a trip signal and SOE data before and after a trip is stored
in an SCS.
ON TRIP (2):
A change to ON is regarded as a trip signal and SOE data before and after a trip is stored in
an SCS.
l P&ID Tag Name

The comment should be written within 16 single-byte characters or 8 double-byte characters.
This setting item can be omitted.
l Command Line
This item does not need to be entered.

<A5. Inter-SCS Safety Communication> A5-1
A5. Inter-SCS Safety Communication

An SCS is able to perform safety communication with other SCSs in the same domain as
well as in different domains. This means that the user can create a safety-loop covering
two SCSs.
SEE
ALSO Always read the following IM when implementing safety communication between SCSs that are connected to the
Vnet/IP network:
ProSafe-RS Vnet/IP (IM 32S56H10-21E)
n Overview of Inter-SCS Safety Communication

The figure below shows an overview of Inter-SCS safety communication.
SEE
ALSO For more information about Inter-SCS safety communication and precaution for engineering, see the followings:
2.8, Inter-SCS Safety Communication of the Engineering Guide (IM 32S01C10-21E)
Diagnostic information message
SCS as a producer (*1) SCS as a consumer (*2)
Data (BOOL, Data (BOOL,

Control bus Representative
integer and real integer and real Data status
error status data status
number types) number types)
SYS_DIAG Function block Function block on SYS_DIAG

function block on the producing side the consuming side function block
Binding (*3)
Binding Binding
variable variable
Control bus
A050001E.ai
Figure Overview of Inter-SCS Safety Communication
*1: An SCS that creates and sends a binding variable

*2: An SCS that receives and reads the binding variable
*3: A mechanism for passing a binding variable of the SCS on the producing side to the SCS on the consuming side

n Mechanism of Inter-SCS Safety Communication

Inter-SCS safety communication is achieved by function blocks dedicated for inter-SCS safety
communication. The function block on the producing side sends setting data as well as data
for guaranteeing communication quality to the communicating SCS via the control bus. The
communication path can be between SCSs in the same domain or SCSs in different domains.
In a configuration with CENTUM integration, inter-SCS safety communication can be performed
while CENTUM devices are connected to the same control bus. The function block on the
consuming side performs various tests on received data to check the validity and only outputs
data whose quality can be guaranteed. If data is judged to be incorrect as a result of these tests,
the fail-safe value preset on the consuming side is output. Make sure to create an application
logic to be used when data is not correct.
IMPORTANT
The output enable operation is required in order for the SCS on the producing side to perform
transmission. The function block on the consuming side outputs the specified fail-safe values
and communication status (parameter NR) becomes abnormal (FALSE) until the output enable
operation is performed.
SEE
ALSO For more information about setting a fail-safe value of the function block on the consuming side, see the
followings:
For BOOL type data, see the following:
C4.4, CONS_B (Inter-SCS Safety Communication BOOL-Type Data Consumer)
For DINT type data, see the following:
C4.5, CONS_I (Inter-SCS Safety Communication INTEGER-Type Data Consumer)
For REAL type data, see the following:
C4.6, CONS_R (Inter-SCS Safety Communication REAL-Type Data Consumer)
n Operation when Launching Inter-SCS Safety Communication

The function block on the consuming side outputs the fail-safe values predefined in the
function block, until the SCS on the producing side starts sending data and the function
block on the consuming side is ready to correctly receive the data sent by the SCS on the
producing side. The communication status (parameter NR) remains abnormal (FALSE)
during this period.
When you start up the SCS on the producing side and perform the output enable operation,
inter-SCS safety communication starts sending data. Once the sent data is successfully
received by the SCS on the consuming side, the function block on the consuming side will
output the received data and the communication status will change to normal (TRUE).

n Operations at Inter-SCS Safety Communication Errors

If a communication error occurs during inter-SCS safety communication, the following operations
are performed.
The fail-safe value preset on the function block for inter-SCS safety communication on the
consuming side is output.
The communication status (parameter NR) becomes abnormal (FALSE).
A diagnostic information message notifying about the error is output.
The following operations are performed if the system recovers from a communication error.
The data value received from the producing side is output from the function block on the
consuming side.
The communication status (parameter NR) becomes normal (TRUE).
A diagnostic information message notifying about the recovery is output.
The operations performed for each error status are summarized below.
Table Operations at Communication Errors

Status Output on the consuming side Remarks
The previous value is retained after the
Start up the SCS on the producing
The SCS on the producing communication stops. After the reception
side and perform the output enable
side stops interval timeout period is exceeded, the
operation to restore communication.
fail-safe value is output.
An error occurs in the
communication path and the Same as above. The data value is output
communication is stopped for when the communication is resumed.
a prolonged period
An error occurs in the The previous value is retained while the
This applies when communication
communication path and the communication is stopped. The data
is resumed within the reception
communication is temporarily value is output when the communication
interval timeout value.
stopped is resumed.
An error occurs in the The previous value is maintained as long The fail-safe value is output if the
communication path and as the communication data is corrupted. communication data is corrupted for
the communication data is The data value is output when correct longer than the reception interval
destroyed data is received. timeout time.
The fail-safe value is output if the
This error is also detected when the
communication is delayed more than
times on the producing side and
A delay occurs in the the transmission delay timeout period.
consuming side deviate significantly
communication path and the The data value is output when the
from each other. Make sure to
communication is significantly communication is resumed.
adjust the system time properly
delayed The transmission delay is not checked if
when the transmission delay is to
the transmission delay timeout value is
be checked.
set to 0.
The fail-safe value is output and a
Erroneous engineering is When a wrong binding variable
diagnostic information message is
performed name is used.
output.

l Time Deviation Caused by GPS Abnormality
With stations connected to the V net where time synchronization among SCSs is performed by
the IRIG-B time synchronization, a time deviation will occur if the GPS or IRIG-B interface fails
because time synchronization by the control bus will not be implemented, either. It may lead to
the transmission delay timeout of the Consumer function blocks (CONS_B, CONS_I, CONS_R).
Table Abnormality and Time Deviation
Abnormality Phenomenon Predicted Deviation
Antenna When antenna error occurs, the standard Deviation varies with the model
time receiver will count the time based of standard time receiver. It is
on its own clock. If the antenna error necessary to query the vendor of
prolonged, the deviation may increase. the recover.
If multiple SCSs are using the same
receiver for time synchronization,
the discrepancy will not occur for the
SCSs. However, if they use different
receivers for time synchronization, the
time discrepancy among the SCSs may
occur.
The Standard Time Receiver When abnormality occurs, each SCS The time discrepancy among
IRIG-B Cable will count the time based on its own SCSs may occur. The maximum
IRIG-B Interface clock. If abnormality is prolonged, the discrepancy is 8.64 sec/day.
deviation from the standard time and the
discrepancy among SCSs may increase.

<A6. SCS Link Transmission> A6-1
A6. SCS Link Transmission

There are the following types of SCS link transmission.
SCS Link Transmission Safety Communication (Safety function)
This establishes a safety communication between SCSs in the same domain. A safety
loop can be established between the sending side and receiving side SCSs.
SCS Global Switch Communication (Interference-free function)
This establishes interference-free communication between SCS and CENTUM
stations (FCS, APCS, and GSGW; hereafter collectively referred to as FCS) in the
same domain.
SEE
ALSO For the basic functions of SCS link transmission, see the following:
2.9, SCS Link Transmission of the Engineering Guide (IM 32S01C10-21E)
For the engineering of SCS link transmission, see the following:
5.3, SCS Link Transmission Definition of the Engineering Reference (IM 32S04B10-21E)
For details regarding SCS Global Switch Communication, see the following:
D6, SCS Global Switch Communication

<A6.1 Overview of SCS Link Transmission> A6-2
A6.1 Overview of SCS Link Transmission

This section generally explains the data structure of SCS link transmission and
definitions required for SCS link transmission.
n Data Structure of SCS Link Transmission

Data sent through SCS link transmission and data received from the stations are first stored in a
dedicated data buffer.
When using SCS link transmission data in application logic, communication data is obtained
using a dedicated input FB. Conversely, to send the result of application logic execution, the
result of application logic should be input to a dedicated output FB.
FCS0101 SCS0102
Control bus
STN01 STN02 STN03 STN64 Link transmission

Image Image Image Image data area
SCS data Output

input FB Logic FB
FCS data
input FB Logic
Application logic
SCS0103
A060001E.ai
Figure SCS Link Transmission Dataflow

l Receive Data
Receive data of SCS link transmission consists of data value and data status. Data status in
SCS link transmission does not indicate the quality of each data item, but rather gives status
information regarding whether data was received normally. SCS determines data status based
on the communication status and safety diagnosis result for each communication target station.
Both data value and data status can be referenced via input FB. Separate input FBs dedicated to
each communicating station type (SCS/FCS) are provided.
l Send Data
Send data of SCS link transmission has data value only and no data status. There is only one
type of output FB, regardless of whether the send destination is SCS or FCS.
l Function Blocks for SCS Link Transmission

In order for application logic to handle SCS link transmission data, the following function blocks
are provided for each communicating station type.
Table Function Blocks Related to SCS Link Transmission

FB type Processing by the function block Remark
LTRCV Inputs link transmission data from other SCSs
Safety
LTSND Outputs link transmission data from local SCS
LTFCS Inputs link transmission data sent from FCS (global switch) Interference-free
SYS_FORCE_LT Manages forcing of SCS link transmission
Safety system FB
SYS_LTSTS Indicates SCS link transmission reception status
SEE
ALSO For details of each function block, see the following:
C4.8, LTRCV (Safety Link Transmission Data Input)
C4.7, LTSND (Link Transmission Data Output)
C6.5, LTFCS (Interference-free Link Transmission Data Input)
C9.3, SYS_FORCE_LT (SCS Link Transmission Lock Status Monitor)
C9.5, SYS_LTSTS (SCS Link Transmission Reception Status Monitor)

n Definition of Send Data

SCS link transmission send should be defined in SCS Link Transmission Builder, and also create
the application logic by using the output FB block of SCS link transmission.
l Definition of SCS Link Transmission Send

To send SCS link transmission data from an SCS to other stations, permit sending via link
transmission in the Self Station tab of SCS Link Transmission Builder.
TIP
At all SCSs in the domain where it is permitted to receive SCS link transmission from the station for which
sending is defined, the application regarding receive data can be changed freely, and such changes do not affect
other stations.
l Wiring of Send Data

To send correct data, define an output FB in the application logic, and perform wiring definition for
the local station data using SCS Link Transmission Builder.
IMPORTANT
If data with no wiring definition at the sending station is referenced at the receiving side station,
data status will be GOOD and data value will be FALSE.
n Definition of Receive Data

SCS link transmission receive should be defined in SCS Link Transmission Builder, and also
create application logic by using the input FB of SCS link transmission.
l Definition of SCS Link Transmission Receive

To receive SCS link transmission data from other stations, permit receiving via link transmission
in the Self Station tab of SCS Link Transmission Builder.
Data received from reception target stations are defined in the Other Stations tab of the SCS link
transmission definition.
If the transmission source station type is SCS, it will be a safety communication and thus the
following items must be defined.
Reception Timeout (Reception interval timeout value): OUTT
Transmission Timeout (Inter-SCS transmission delay timeout value): DLYT
Pre-Alarm (Pre-alarm setting value): PALT
SEE
ALSO For items to note on setting OUTT, DLYT and PALT, see the following:
n Precaution for Engineering of 2.9, SCS Link Transmission of the Engineering Guide (IM 32S01C10-
21E)
l OUTT (Reception Interval Timeout Value) Setting

Reception interval is an interval between data received by an SCS. If normal data is not received
within the reception interval timeout value (OUTT), it is regarded as a communication error. This
value can be set between 3 and 30 seconds.
l Inter-SCS Transmission Delay Time and Reception Interval
Inter-SCS transmission delay time is the elapsed time after the sending side SCS transmits the
data until the receiving side SCS receives the data. If the inter-SCS transmission delay time is
outside the normal range, the received communication frame is ignored.
The transmission delay time is affected not only by the delay in the communication path but also
by the difference in scan period settings of the SCS application logic execution function at the
sending side and receiving side. The time deviation between the sending side SCS and receiving
side SCS may also affect the inter-SCS transmission delay time check.
Sending Receiving
side SCS side SCS
Inter-SCS transmission delay time
Reception interval
Time
A060002E.ai
Figure Inter-SCS Transmission Delay Time and Reception Interval
l DLYT (Inter-SCS Transmission Delay Timeout Value) and PALT (Pre-alarm

Setting Value) Setting
DLYT
Set an appropriate value for DLYT (inter-SCS transmission delay timeout value) according
to the SCS time synchronization method. The normal range for transmission delay is as
follows:
- (minus) DLYT Inter-SCS transmission delay time DLYT
If the state where the occurrence of delay outside the normal range continues longer than
the time which is specified as OUTT, it is regarded as a communication error.
DLYT can be set to 0 seconds or between 3 and 30 seconds. When DLYT is set to 0, the
inter-SCS transmission delay check is disabled.
PALT
By using PALT, application logic can be notified of the generation of transmission delay
through SYS_LTSTS before the inter-SCS transmission delay time reaches DLYT.
Diagnostic information message is not generated.
PALT can be set to 0 seconds or between 3 and 29 seconds. When PALT is set to 0, a pre-
alarm is not generated.
Set the values so that PALT is smaller than DLYT, unless DLYT is set to 0.
Relationship between DLYT and PALT
PALT check is performed unless PALT is set to 0. Pre-alarms are checked even if DLYT is
set to 0.
IMPORTANT
If both PALT and DLYT are set to 0, the receive data of SCS link transmission cannot be used for
safety purposes.

l Wiring of Receive Data
To use the receive data of SCS link transmission in application logic, define an input FB
according to the station type, and then perform wiring definition of data for each receiving side
station in SCS Link Transmission Builder.
During wiring definition, the input value at error occurrence should also be defined.
IMPORTANT
If wiring of the receive data from a nonexistent station is defined, the data status will always be
BAD and the data value will be the input value at error occurrence.

<A6.2 Actions Taken for SCS Link Transmission when SCS is Unsteady> A6-7
A6.2 Actions Taken for SCS Link Transmission

when SCS is Unsteady
This section explains the actions taken for SCS link transmission safety communication
when the SCS is unsteady, as well as the operation at a SCS link transmission error
occurrence.
SEE
ALSO For actions taken for SCS global switch communication when the SCS is unsteady, see the following:
D6, SCS Global Switch Communication
n SCS Link Transmission Safety Communication during SCS Startup

During SCS startup, SCS link transmission safety communication is processed in the following
manner.
l Start of Reception
When the SCS is started, reception of SCS link transmission starts.
l Start of Sending and Status of Data

Even when the SCS is started, if the output enable operation is not performed, SCS link
transmission data will not be sent. In this case, logical data of the receiving side link transmission
data area will be the input value at error occurrence specified in [Input Processing at Fault] item
of Data Wiring Definition in SCS Link Transmission builder (FALSE if specified as HOLD). The
data status will be BAD.
When the output enable operation is performed at the sending side SCS, sending of data starts
and logical data of the receiving side SCSs link transmission data area will be the value sent by
the sending side SCS, and the data status will be GOOD.
Case where the sending
side SCS is in the Output Data value: Received data value
Enable status Data status: GOOD
Case where the sending Data value: Input value at error

side SCS is not started yet Data value: Received data value
occurrence
Data status: GOOD
Data status: BAD
SCS startup Sending side Sending side SCS

(local station) SCS startup output enable operation
A060101E.ai
Figure SCS Link Transmission Safety Communication Receive Data during SCS Startup
TIP
After the output enable operation is performed, sending of SCS link transmission will not be placed in the Output
Disable status until the SCS is stopped.

l Notification of errors and recovery during SCS startup
During the SCS startup, errors related to SCS Link Transmission are handled as follows:
During the SCS startup, no diagnostic information message on SCS Link Transmission
errors will be sent. After the error status during the startup turns to normal, diagnostic
information message on errors will be sent at the error occurrence.
No diagnostic information message notifying recovery from errors of SCS Link Transmission
that occurred during the SCS startup will be sent.
n Diagnosis of SCS Link Transmission Safety Communication

During inter-SCS link transmission safety communication, the following diagnoses are
performed.
The receiving side SCS checks if correct data is received within the reception interval
timeout value (OUTT). If a timeout occurs, it is judged that a communication error has
occurred. Until then, the last normal value is retained.
In addition to the setting data, the sending side SCS appends data to guarantee
communication quality and sends the data to the communicating SCS. The receiving side
SCS performs various verifications to confirm validity of data sent by the sending side SCS.
If the result of verification indicates abnormality, it is judged that a communication error has
occurred.
n Processing upon SCS Link Transmission Safety Communication Error

When the result of SCS link transmission safety communication diagnoses indicates an error, the
following processing takes place.
l Receive Data/Data Status

Logical data of the link transmission data area received will be set according to the
specified input value at error occurrence defined in the Data Wiring definition of SCS Link
Transmission Builder.
The data status will be BAD.
The data and data status above are output from the LTRCV function block.
l Notification of Communication Error

A diagnostic information message indicating Diagnostic Error will be sent from each receiving
station where a communication error has occurred. However, no diagnostic information message
notifying errors related to SCS Link Transmission will be sent during the SCS startup.
SEE
ALSO For details on diagnostic information messages, see the following:
No. 4133 in 2.1, System Alarms of the Messages (IM 32S02B10-21E)

n Processing upon Recovery from SCS Link Transmission Safety

Communication Error
After the cause of communication error is removed and receive data from the SCS becomes
normal, the error condition recovers automatically. If latching the data at communication error is
necessary, write the data latching logic in application logic.

Logical data of the link transmission data area received will be the value sent by the sending
side SCS.
The data status will be GOOD.
The data and data status above are output from the LTRCV function block.
l Notification of Recovery from Communication Error

A diagnostic information message indicating Recovery from Diagnostic Error will be sent from
each receiving station where a communication error has been recovered. However, no diagnostic
information message related to SCS Link Transmission notifying the recovery from the errors that
occurred during the SCS startup will be sent.
SEE

n Operations of SCS Link Transmission Safety Communication upon

Time Synchronization Error
For SCS Link Transmission Safety Communication, a time synchronization error may cause the
transmission delay timeout at the receiving side SCS.
l Time Deviation Caused by GPS Failure

When the SCS time is synchronized by IRIG-B time synchronization, faulty GPS or IRIG-B
interface may cause the following time deviation since time synchronization with control bus will
not be performed. This time deviation may cause the transmission delay timeout at the receiving
side SCS.
Abnormality Phenomenon Predicted Deviation
Antenna When antenna error occurs, the standard Deviation varies with the model
time receiver will count the time based of standard time receiver. It is
on its own clock. If the antenna error necessary to query the vendor of
prolonged, the deviation may increase. the recover.
If multiple SCSs are using the same
receiver for time synchronization,
the discrepancy will not occur for the
SCSs. However, if they use different
receivers for time synchronization, the
time discrepancy among the SCSs may
occur.
The Standard Time Receiver When abnormality occurs, each SCS The time discrepancy among
IRIG-B Cable will count the time based on its own SCSs may occur. The maximum
IRIG-B Interface clock. If abnormality is prolonged, the discrepancy is 8.64 sec/day.
deviation from the standard time and the
discrepancy among SCSs may increase.
l Supplemental Explanation on Transmission Delay Timeout Value (DLYT)

The transmission delay error of the SCS link transmission safety communication needs to be
detected.
A temporary transmission delay error can be detected by monitoring the reception interval
timeout (OUTT). A permanent transmission delay error can be detected with DLYT.
DLYT will detect not only the transmission delay but also the time deviation among SCSs. Thus,
set the DLYT with the consideration of the time deviation so as to prevent the false trip.
When the IRIG-B time synchronization is used, consider the time deviation that could be
caused by faulty GPS or IRIG-B Interface.
Confirm that the same type of time synchronization method is applied to all the SCSs
performing the SCS link transmission safety communication, and then set the DLYT with the
consideration of the time discrepancy of SCSs so as to prevent the false trip.
n SCS Link Transmission during Switching of CPU Control Right

Switching the control right of a dual-redundant CPU module does not affect the receive data.
n SCS Link Transmission during Error at One Side of Control Bus

An occurrence of error at one side of control bus does not affect the receive data.

<A6.3 Forcing of SCS Link Transmission Data> A6-11
A6.3 Forcing of SCS Link Transmission Data

Forcing of SCS link transmission data can be performed from the SCS Link Transmission
Lock window of the SENG. The forcing function does not distinguish the SCS link
transmission safety communication and SCS global switch communication.
Forcing of SCS link transmission data can be performed when the SCS security level is 1
or lower.
TIP
Forcing of SCS link transmission data can be performed only from the SCS Link Transmission Lock window.
Forcing (lock operation, viewing lock status, setting values) cannot be performed by selecting link transmission-
related function blocks in Dictionary View.
SEE
ALSO For the SCS Link Transmission Lock Window, see the following:
2.2, SCS Link Transmission Lock Window of the Utilities and Maintenance Reference (IM 32S04B20-21E)
n Function Configuration of SCS Link Transmission Data Locking/

Unlocking
The relationship between data configuration, lock/unlock operation, and output enable operation
regarding SCS link transmission data within an SCS is shown below.
SCS
SCS link transmission data management
Receive/Send buffer
Output Enabled/
Disabled status
Physical data area Physical data area
Locked status Locked status
Logical data area Logical data area
Input FB Logic Output FB
Application logic execution function
A060201E.ai
Figure SCS Link Transmission Data Locking/Unlocking
SCS link transmission data has logical data and physical data, like input/output variables.
These data can be referenced from the SCS Link Transmission Lock window.
If the SCS link transmission is locked, logical data of the receive data and physical data of
the send data can be set to any value from the SCS Link Transmission Lock window.

n Locking SCS Link Transmission Data

It is possible to lock link transmission data of each station individually.
When the local station is selected and locked, the send data will be locked. None of the
output FB data values will be set to the physical data. The SCS sends the current value of
physical data to other stations.
If a receiving station is selected and locked, data from the applicable station (data value and
data status) will be set only to the physical data but not to the logical data.
Value setting

Receive Data value Data value Input
data buffer Data status Data status FB
Locked status
Logic

Send Data value Data value Output
data buffer FB
Locked status
Value setting
A060202E.ai
Figure Forcing of SCS Link Transmission Data
n SCS Link Transmission Data Value Setting

Setting the value of locked data can be performed for each data item.
Value setting is possible only for data whose wiring to the SCS link transmission function
block is defined.
A data status can be set for the receive data. However, this will be common for all data of the
receiving station. The status cannot be changed for individual data item setting.
TIP
In the Output Disable status, data will not be sent even when the send data is locked and the data value is set. If
the output enable operation is performed in the locked status, the set data will be sent.
n Management of SCS Link Transmission Lock Status

The SCS link transmission function manages not the number of locked data items, but the
number of stations set by the local SCS as targets of link transmission lock.
When the receive data from a target station is locked, it will be counted in the number of
locked stations regardless of whether it is SCS or FCS.
If the link transmission receive definition of a data from locked receiving station is changed
from [Yes] to [No] in SCS Link Transmission Builder and downloaded to the SCS, the
number of locked stations is decremented.
The number of SCS link transmission lock target stations is displayed in the SCS operation
status display of SCS maintenance support tool and HIS. It can also be referenced with
application logic using a system function block.

l System Function Block that Manages Locked Status of SCS Link Transmission
Using the system function block (SYS_FORCE_LT) in an application logic allows you to
unlock all SCS link transmission data as well as to monitor elapsed time of locked status.
SEE
ALSO For SYS_FORCE_LT, see the following:
C9.3, SYS_FORCE_LT (SCS Link Transmission Lock Status Monitor)
The locked status of SCS link transmission data is managed separately from locked input/
output modules or variables. Locking the SCS link transmission data does not affect the
SYS_FORCE or SYS_FORCE_SC system function blocks.
l Locked Status Notification by Diagnostic Information Messages

The SCS link transmission function sends a diagnostic information message with lock/unlock
operation. Checking the diagnostic information message allows you to see which stations data
has been locked/unlocked.
SEE
ALSO For diagnostic messages regarding SCS link transmission lock/unlock, see the following:
No. 4135 and No. 4136 in 2.1, System Alarms of the Messages (IM 32S02B10-21E)
n Using Forcing during SCS Maintenance

When the SCS link transmission send data is affected by online change of the application, lock
the local station before performing the online change download operation. This can prevent
generation of false trips at the receiving side station. When the online change download is
complete, confirm that the data to be sent is valid in the SCS Link Transmission Lock window,
and then unlock the station.
SCS0102
Lock the Ready
sending side
SCS0101
Ready
SCS0103
Ready
Change
application logic
F060203E.ai
Figure Locking SCS Link Transmission during Online Change

<A7.1 Overview of SOER> A7-1
A7. SOER
SOER (Sequence of Events Recorder) is a function for recording events detected by an
SCS so that they can be used in analyses. In ProSafe-RS, it can be used in such a way
that users can analyze causes of events based on event information obtained before/after
tripping.
This chapter explains SCS functions related to the SOER function. Refer to related
explanations for engineering tasks of SOER, SOE Viewer and the host interfaces.
SEE
ALSO For the items to note when configuring a SOER, see the following:
2.13, Configuration of the SOER of the Engineering Guide (IM 32S01C10-21E)
For SOER engineering tasks, see the following:
7, SOER Collection Definition of the Engineering Reference (IM 32S04B10-21E)
For SOE Viewer, see the following:
4, SOE Viewer of the Utilities and Maintenance Reference (IM 32S04B20-21E)
For the host interfaces, see the following:
A1, SOE OPC Interface of the Open Interfaces (IM 32S05B10-21E)
A7.1 Overview of SOER

With a SOER, changes in analog inputs/outputs, discrete inputs/outputs and application
logics can be collected/saved as event information. Collected event information is
displayed in the SOE Viewer. Moreover, a function to synchronize to the standard time is
provided in order to maintain the accuracy of the time stamps attached to the events.
n ProSafe-RS SOER
l Configuration
The SOER function of ProSafe-RS can be used for a minimum system configuration, i.e., one
SENG and one SCS.
l Event Collection
The SOER function of ProSafe-RS can collect changes of not only discrete inputs (DI) but
also discrete outputs (DO) as event information.
Analog input values can also be collected as event information.
By creating FBs for SOER, changes of analog output values and application logics can be
collected as event information. By doing so, changes of communication data with other
SCSs can also be recorded.

l Event Saving
You do not need to prepare a dedicated PC for saving events or keep the power supply to
an SENG on at all times, because event information is saved in the SCS.
The maximum number of event information records that can be saved in an SCS is 15000.
You can be sure that users are successfully notified of particularly important event
information, i.e., records acquired before and after a trip signal was generated, by
separating the storage location.
l Selection of Standard Time Synchronization Method

The time synchronization function maintains the accuracy of time stamps attached to recorded
events. SCSs connected to the V net can select either method: the method by which external
standard time is acquired through the IRIG-B interface, or the method by which the SCS is
synchronized with the systems V net time. The default setting is to use the V net time.
SCSs connected to the Vnet/IP can only use the Vnet/IP time synchronization where the SCS is
synchronized with the Vnet/IP time regardless of whether or not an SNTP server is installed.
l GPS Receiver (Optional)

With SCSs connected to the V net, a GPS receiver (commercially available product) is used
to acquire the standard time from the GPS. Specifically, time information of IRIG-B format is
acquired by the SCS. This time synchronization method is optional and therefore not mandatory.
l SOE Viewer
Event information saved in an SCS can be read by the SOE Viewer function in an SENG via
the control bus.
SOE Viewer allows filtering the event information so that only the information the user wants
to see is shown.
SOE Viewer can display diagnostic information messages as well.

n Relationship among the SOER Functions

The figure below illustrates a structure of functions related to SOER.
SENG
Event display function
SOER definition function
Control bus
Download Upload
CPU Module
Time synchronization Event collection Event storage
function function function
Download
Time setting
DI module Event collection

function
SCS
A070101E.ai
Figure Relationship between SCS and SENG (Time Synchronization with IRIG-B)
The user defines items related to SOER on an SENG. The defined information is downloaded
to the CPU of an SCS as well as to discrete input modules in the system. The event information
collected/saved in the SCS is uploaded to SOE Viewer in the SENG or HIS.
With SCSs connected to the V net, IRIG-B time synchronization can be selected.
With SCSs connected to the Vnet/IP, time synchronization is implemented based on the Vnet/IP
time.

<A7.2 Event Collection> A7-4
A7.2 Event Collection

An SCS allows saving specified discrete inputs, discrete outputs and variable data of
application logics as event information.
n Event Targets
An SCS can save the following data as event information by user specification.
Events related to discrete inputs (DI) are collected by the input modules; other events are
collected by the CPU.
l Events of Discrete Inputs (DI)

Discrete input modules detect changes in the input signals input to each channel (FALSE to
TRUE or TRUE to FALSE) and collect events.
Users can specify whether or not to collect SOE event information for each channel.
If discrete input modules are placed in redundant configuration, the active module collects
events.
The comment text attached to the variable corresponding to each DI channel is added to
the event. The text can contain a character string of up to 32 single-byte characters, or
16 double-byte characters. The user needs to define the variables corresponding to the
contact inputs on the Workbench Dictionary View as the comments so as to identify the
whereabouts of the occurred events.
l Events of Discrete Outputs (DO)

The CPU detects changes in the output value set to a discrete output module and collects
events.
Users can specify whether or not to collect SOE event information for each channel.
For dual-redundantly configured contact output modules, the signals output from the active
module are gathered as the events.
If the output channel is abnormal (data status is BAD), the events will not be gathered.
Each event is attached with a comment text assigned as a variable to the contact output
(a character string of up to 32 single-byte characters or 16 double-byte characters). The
user needs to define the variables corresponding to the contact outputs on the Workbench
Dictionary View as the comments so as to identify the events.

l Events of Analog Inputs (AI)
The ANLG_S function block outputs alarms by judging analog input values, so it is able
to collect events by making appropriate application. It performs magnitude correlation
comparison of set values and analog output values (OUT) and collects events by using a
change in OUT as a trigger.
Events are collected when the SOER input terminal is set to TRUE.
At event collection, a character string set to the ID input (a character string of up to 32
single-byte characters or 16 double-byte characters) is stored along with the event data.
ANLG_S
IN OUT
SH STS
SL NHTR
HH NHHH
PH NLLL
PL NLTR
LL
HYS
TRDT
PADT
SOER
ID
A070201E.ai
Figure ANLG_S function block
An ANLG_S function block collects events when the following outputs change their status from
FALSE to TRUE, or from TRUE to FALSE:
NHTR (HI trip flag)
NHHH (HI pre-alarm flag)
NLLL (LO pre-alarm flag)
NLTR (LO trip flag)
When the event occurred can be checked in the ID field of the SOE Viewer.
Table ANLG_S Event IDs
ID in SOE Viewer Occurrence timing of event
EVT_TRUE When an alarm recovered (when output status change from FALSE to TRUE).
EVT_FALSE When an alarm generated (when output status change from TRUE to FALSE).

l Events of Application Logic Variables
An SCS collects values of internal variables defined in an application logic as events by
connecting them to function blocks dedicated to the SOER function. Variables of the BOOL,
integer or real number types can be collected. At event collection, a character string specified in
the ID input (a character string of up to 32 single-byte characters) is stored along with the event
data.
Use SOE_R to collect analog output events. In IN, enter an output variable. In TRIG, enter a
signal that specifies the event collection timing.
The following function blocks are dedicated to the SOER function. Note that events from function
blocks are treated as trip signals if TRIP_OFF or TRIP_ON is specified for TRP.
SOE_B (BOOL type) function block

SOE_B is a function block used to collect BOOL-type data as events. It collects events if
there is a difference between the input value (IN) and the previous value at the execution
timing of the function block. The default value of the previous value is 0.
SOE_B
IN
TRP
ID
A070202E.ai
Figure SOE_B function block
SOE_I (integer type) function block

SOE_I is a function block used to collect integer-type data as events. It collects events if the
value of TRIG, an input terminal, changes at the execution timing of the function block.
SOE_I
IN
TRIG
TRP
ID
A070203E.ai
Figure SOE_I function block
SOE_R (real number type) function block

SOE_R is a function block used to collect real number-type data as events. It collects events
if the value of TRIG, an input terminal, changes at the execution timing of the function block.
SOE_R
IN
TRIG
TRP
ID
A070204E.ai
Figure SOE_R function block

When the event occurred can be checked in the ID field of the SOE Viewer.
Table Event IDs of Dedicated SOE Function Blocks
FB type ID in SOE Viewer Occurrence timing of event
EVT_TRUE When the status of IN input changed from FALSE to TRUE.
SOE_B
EVT_FALSE When the status of IN input changed from TRUE to FALSE.
SOE_I EVT_TRUE When the status of TRIG input changed from FALSE to TRUE.
SOE_R EVT_FALSE When the status of TRIG input changed from TRUE to FALSE.
n Event Time
Event information records include a time stamp indicating when the event occurred. The event
generation time varies depending on the event type (object).
Table Event Time
Object Time information of event
Discrete input (DI) The current time of a discrete input (DI) module at event generation is recorded.
The current SCS time is stamped to the signal right before outputting it through the
Discrete output (DO)
output module.
The current time of the SCS right before the execution timing of a function block is
Variable
recorded.
l Recording of Occurrence Times of DI Module-related Events

After an occurrence of channel failure, such as open or short circuit, if you check the SOE Viewer
to view a diagnostic information message, you will find that the channel error is displayed after
the ON/OFF event of the applicable channel. This means that the time of event occurence does
not match the time of the message. This is because the event and the message are generated
by different modules: the DI module generates events and the CPU module generates diagnostic
information messages.
When an event occurs, event information is generated based on the DI module time at the
occurrence. On the other hand, diagnostic information messages for channel errors, etc., are
generated during I/O refresh processing of the CPU module based on the error information
received from the DI module, in accordance with the time information acquired at the start of
each scan period.

<A7.3 Event Storage> A7-8
A7.3 Event Storage

Event information is stored in the SOER event information storage memory of an SCS.
There are two types of files in which event information can be stored: an event log file and
trip signal files. An event log file stores the latest event information. In the trip signal file,
events before and after each trip signal are saved.
n Saving Event Data

An SCS saves event data using two types of files: an event log file, which stores event
information in the order of data collection, and trip signal files, which store events generated
before and after the trip signal specified by the user. There are two trip signal files.
Event information saved in an SCS is not deleted when read by an SENG and HIS. It is thus
possible to reference the information from multiple SOE Viewers.
n Flow of Event Storage

The figure below illustrates the flow according to which event information is stored in an SCS.
SOE Viewer
CPU
Application logic
Events of DO
and variables
Event log file
DI event SOER event

temporary information
storage memory storage memory
Trip signal Trip signal file

definition
Event of DI
DI module
A070301E.ai
Figure Flow of Data in Event Information Storage
Since event information from a discrete input (DI) module is automatically stored in the DI event
temporary storage memory of the CPU, both the DI event in this memory and event information
collected in the application logic are stored in the SOER event information storage memory.

n Specification of Event Log Files

An event log file stores the latest event information and one event log file is saved per SCS.
Up to 15,000 events can be saved in the event log file.
If the number of events saved exceeds the maximum number, events are deleted and
overwritten by new events from the oldest one.
Whenever an SCS has saved 12,000 events in the event log file, it sends a diagnostic
information message to prompt the user to upload to the SENG.
n Trip Signal
Trip signals are particularly important events in the plant. Since they are key events when
engineers attempt to analyze the causes of tripping, they must be securely stored in the
SCS together with the events generated before and after them.
Either ON edge or OFF edge can be specified as the trip signal. However, both edges can
be specified as ignored.
Users can specify trip signals in input/output definitions or in function blocks for SOE. There
is no restriction on the number of trip signals that can be specified, but it is necessary to
examine trip signal settings thoroughly in order to record useful event information.
n Specification of Trip Signal Files

Trip signal files store events generated before and after a trip signal specified by the user.
An SCS stores events generated before and after the trip signal in a trip signal file.
A trip signal file stores 1,500 events in total: the last 500 events generated before tripping
including the trip signal and the 1,000 events generated after tripping.
Up to two trip signal files can be stored in an SCS. No more trip signal files are saved even
if more trip signals are generated. If two trips occur in a short period of time, the data in the
two trip signal files may overlap.
If less than 500 events are collected prior a trip event occurs, the number of the events
before the trip event will be less than 500.
The file will be closed when 1000 events are collected after the trip event. However, the
number of events after 30 minutes of the trip event is less than 1000, the file will be closed
anyway with less events.
An SCS sends a diagnostic information message when saving of a trip signal file is
completed.
Trip signal files are not automatically initialized by the system. These files can be initialized
only via operation from the SENG.
SEE
ALSO For the initialization of trip signal files, see the following:
3.4.5, Initialization of Tripping Information of the Utilities and Maintenance Reference (IM 32S04B20-21E)

l Initialization of Trip Signal Files
Trip signal files can be initialized only via initialization operation from the SENG. After you have
uploaded events from the SOE Viewer on the SENG, initialize the trip signal files using the
Message Cache Tool of the SENG.
Up to two trip signal files can be initialized with a single operation.
Initialization operation is also valid while events are being stored.

<A7.4 Management of Event Information when SCS is Unsteady> A7-11
A7.4 Management of Event Information when

SCS is Unsteady
An SCS is considered to be unsteady if it is in one of the following conditions:
A power failure occurs in the SCS
During startup of the SCS
Input/output variables are locked
If a power failure occurs in an SCS, event information is saved in a memory backed up by

a battery. The SCS restores the event information at startup; it is thus possible to check
the event information before the SCS was stopped.
n Protection of Event Information at Power Failure

Under normal circumstances, event information is stored in the main memory of an SCS. If
a power failure occurs in the CPU, the data saved in the main memory is lost. Therefore, the
SCS saves the most recent events recorded immediately before the power failure to a different
memory backed up by a battery. Although all the events cannot be protected, it is possible to
analyze events that occurred immediately before the power failure by protecting them in this way.
Table Protection of Event Information at Power Failure
File type Specifications at power failure occurrence (*1)
The most recent 1000 events recorded immediately before the power failure are
Event log file
protected.
Upon completion of collection, the trip signal files are saved to a memory backed
up by a battery (up to 1500 events x 2 files). If the files have been fully saved prior
Trip signal file
to the power failure, all events are safe. If the power failure occurred before the
files are fully saved, the events are lost. (*2)
*1: The same operations apply to off-line download.
*2: If the most recent events are not saved, refer to the event log file.
n SCS Startup Operation

An SCS restores the event information that was saved before it was stopped when it starts up at
restarting or after off-line download.
n Lock Status by the Forcing Function

If input/output variables are locked by the forcing function, event collection is performed in the
following ways when the values of the input/output variables change.
Table Event Collection Operation in the Locked Status
Object Event collection operation
Since events are collected by a discrete input module, events are collected based
Discrete input (DI) on the actual values input to the module regardless of the lock status. Events are
not collected if the value of the discrete input is changed by the forcing function.
Since events are collected by an application logic, events are collected with the
Discrete output (DO) (*1)
changed value if the values of input/output variables are changed by the forcing
Analog input (AI)
function.
*1: In order to collect events, it is necessary that the DO modules are operating normally and the data status of the output channels
are GOOD.
SEE
ALSO For more information on SOE event collection when the module control right is switched, see the following:
B7.1, Redundant Configuration in SCS

<A8. Forcing> A8-1
A8. Forcing
Forcing is used in the maintenance of SCSs and debugging of applications. Specifically,
a user interface is provided that can be used to lock I/O modules, variables and FB
parameters, and set desired values. Forcing can be used when the SCS security is Level 1
or below.
SEE
ALSO For the items to note when performing engineering work relating to forcing, see the following:
7.2.3, Forcing and Override of the Engineering Guide (IM 32S01C10-21E)
For the forcing operations, see the following:
2, Forcing Function of the Utilities and Maintenance Reference (IM 32S04B20-21E)
For forcing of subsystem communication data, see the following:
C1.5, Forcing of Subsystem Communication Data of the Open Interfaces (IM 32S05B10-21E)
For forcing of SCS link transmission data, see the following:
A6.3, Forcing of SCS Link Transmission Data
This chapter explains forcing of variables, parameters of function blocks, and inter-SCS
safety communication as well as applications of forcing.

<A8.1 Variable Locking> A8-2
A8.1 Variable Locking

It is possible to fix (lock) values of input/output variables and internal variables of the
application logic to constant values, regardless of the input values from the actual input
devices and application operation results.
This section describes the behaviour of the input variables, the output variables and the
internal variables when they are locked, as well as the behaviour of the system function
blocks during locking.
n Overview of Variable Locking

All variables of the application logic have two values: a value written from the input side and a
value read from the output side. Normally, the value on the output side is constantly overwritten
with the value on the input side during the execution of the application logic. For this reason, the
value written to the variable and the value read from the variable match each other.
The locking function is a function to stop overwriting values on the output side with values on the
input side. As a result, the values maintained on the output side are used regardless of the values
from the input side.
Variable Variable
Value on the Value on the Value on the Value on the

input side output side input side output side
Locked status Unlocked status

A080101E.ai
Figure Overview of the Locking Function
In the case of an input variable, the value on the input side is the input from the input channel and
is called physical data. The value of an input variable on the output side is read by the application
logic and is called logical data.
An input variable consists of input data and data status.
In the case of an output variable, the value of the input side is the result of application logic
processing and is called logical data. The value of the output side of an output variable is the
output to the output channel and is called physical data. An output variable also consists of output
data and data status, in the same way as an input variable.
WARNING
When unlocking input/output variables, make sure to check the logical data and physical
data of input/output data and data status. Check that there will be no adverse effects
of unlocking on the system, such as a value changing abruptly after canceling the lock,
causing nuisance tripping.
While the forcing function is executed, the systems safety functions are disabled. If you use
the forcing function for the purpose of maintenance after starting the actual operation, quit
the forcing function immediately after the completion of system maintenance and enable the
systems safety functions so that they operate normally. At the completion of a target test
or when quitting SCS Manager during a target test, a dialog box appears to call attention
to locked variables. In this case, display a list of the locked variables using the I/O Lock
window or other means and cancel the lock status of these variables.

n Locking Input Variables

If an input variable is locked, the value of the input variable will no longer be overwritten with the
value input from the input channel. The input data and data status from the input channel and
those from the input variable are separated.
Input variable

Input module
Input channel
A080102E.ai
Figure Locking Input Variables
If an input variable is locked, its logical data will no longer be overwritten with the value of the
physical data. The value of the logical data matches the value of the physical data at the time of
locking for both the input data and data status. The locked variable values can be changed after
the lock operation.
SEE
ALSO For more information about variable value setting, see the following:
A8.2, Variable Value Setting
l Unlocking Input Variables

When the lock status of an input variable is canceled, the logical data will be overwritten with
the value of the physical data again. Since input data values used by the application logic may
change abruptly or the data status may change, caution is required not to adversely influence
the operation of the application. For this reason, before canceling a lock, make sure to check that
input data and data status match for physical data and logical data; if they are different, make
sure that there will be no adverse effect on the application when unlocking.
l Operations at Input Channel Errors

While an input variable is locked, the data status of the input channel is disconnected. For this
reason, even if an error occurs in the channel, the error cannot be detected by observing the data
status of the input variable. Note that a diagnostic information message is notified at failure of the
channel as well as its recovery from an error, regardless of whether or not the input channel is
locked.
l Notification of Operation Result via Diagnostic Information Messages

If an input variable is locked or unlocked, the operation performed and the results of the operation
are notified as a diagnostic information message.
SEE
ALSO For more information about acknowledging diagnostic information messages, see the following:
3.2, Displaying SCS Diagnostic Information of the Utilities and Maintenance Reference (IM 32S04B20-
21E)

n Locking Output Variables

If an output variable is locked, the value of the output variable will no longer be overwritten with
the value set by the application logic. The output channel and application logic are disconnected.
For output variables, the data status flows in the opposite direction of the output data.
Output variable
Output module
Output channel
A080103E.ai
Figure Locking Output Variables
If an output variable is locked, its values are fixed as follows.

As for the output data, its physical data will no longer be overwritten with the value of the
logical data. The value of the physical data matches the value of the logical data at the time
of locking.
As for the data status, the logical data status will no longer be overwritten with the value
of the physical data status. The value of the logical data status matches the value of the
physical data status at the time of locking.
l Unlocking Output Variables

When the lock status of an output variable is canceled, the physical data will be overwritten
with the value of the logical data again for the output data, and the logical data status will be
overwritten with the value of the physical data status again. When the lock status is canceled, the
output data values overwritten with the application logic may change or the data status used in
the application logic may change. Thus, caution is required not to adversely influence the output
to the field and the operation of the application. For this reason, before releasing a lock, make
sure that the output data and data status of the physical data and logical data are consistent; if
they are not, make sure that there will be no inadvertent affect to the applications when releasing
the lock.
l Operations at Output Channel Errors

While an output variable is locked, the data status of the output channel is disconnected. For this
reason, even if an error occurs in the channel, the error cannot be detected by observing the data
status of the output variable. Note that a diagnostic information message is notified at the time of
failure of the channel as well as its recovery from an error, regardless of whether or not the output
channel is locked.

If an output variable is locked or unlocked, the operation performed and the results of the
operation are notified as a diagnostic information message.
SEE
21E)

n Locking Internal variables

If an internal variable is locked, it will no longer be overwritten by an input value or an application.
If an array used in a ST (Structured Text) statement is locked, all the elements of the array will be
locked.
In the case of SCSP2, internal variables can be locked only when [Yes] is set for [Extend Scan
Period Automatically] and [Enable] is set for [Locking of Internal Variables] on the SCS Constants
Builder. Note that if any internal variable is locked, processing time of the application logic
becomes longer.
SEE
ALSO For more information about the relationship between locking of internal variables with SCSP2 and performance of
SCS, see the following:
n Locking of Internal Variables and Performance: SCSP2 in 2.7, Performance and Scan Period in SCS
of the Engineering Guide (IM 32S01C10-21E)
In the case of internal variables, the value on the input side is called physical data and the value
on the output side is called logical data.
Internal variable
Data Physical data Logical data

A080104E.ai
Figure Locking Internal Variables
If an internal variable is locked, its logical data will no longer be overwritten with the value of the
physical data. The value obtained by reading the internal variable is fixed with the value of logical
data. The value of the logical data matches the value of the physical data when locked.
l Unlocking Internal Variables

When the lock status of an internal variable is canceled, the logical data will be overwritten with
the value of the physical data again. For an array, all the elements of the array will be unlocked.
Since the data value overwritten with the application logic may change, caution not to adversely
influence the operation of the application. For this reason, before canceling a lock, make sure to
check that the data match for physical data and logical data; if they are different, make sure that
there will be no adverse effect on the application when unlocking.

If an internal variable is locked or unlocked, the operation performed and the results of the
operation are notified as a diagnostic information message.
SEE
21E)

n Operations of System Function Blocks during Locking

System function blocks are divided into two types: those to which the actual status is notified
regardless of the lock status of a variable, and those to which no module and channel errors are
notified while a variable is locked.
Function blocks to which the actual status is notified regardless of the lock status
SYS_IOMDSP, SYS_DIAG, SYS_ALRDSP, SYS_OUTEN, SYS_ESBINF, SYS_NODEINF
Function blocks to which no module and channel errors are notified during locking
SYS_IOALLST, SYS_NODEST, SYS_OUTST, SYS_OUTST16, SYS_INST, SYS_CHST,
SCI_B, SCI_I, SCI_R, SCO_B, SCO_I, SCO_R

<A8.2 Variable Value Setting> A8-7
A8.2 Variable Value Setting

It is possible to set values for input/output variables and internal variables while they are
locked. For a locked array, user can set values to the variables for each array element one
by one. Values of variables can be set in the I/O Lock window, Multi-Language Editor and
Dictionary View.
If a value is set for a variable while it is locked, the value is fixed to the set value. When
changing a value for a variable while it is not locked, error will occur and the value cannot
be changed. However, when the SCS security level is Level 0, the internal variable and
function block parameter values can be set and locking is not necessary.
This section describes operations performed when a value is set for each type of
variables, namely, input variable, output variable and internal variable.
n Setting Values for Input Variables

In the case of input variables, the variable setting function sets the values of both input data and
data status to the corresponding values of the logical data.
Variable value setting
y b
Input variable

x y
a b
...
Locked status
Input module

y b
Input variable Error

x x
a a
...
...
Unlocked status
A080201E.ai
Figure Setting Values for Input Variables
If a variable is locked
The physical data is always updated with the value actually input from the input channel.
The value of the logical data, on the other hand, is fixed to the set value because the
physical data and the logical data are disconnected. In the application logic, the value fixed
for the logical data is used, rather than the actual input value.
If a variable is not locked
When changing the data status or data value, an error will occur and the value cannot be
changed.

n Setting Values for Output Variables

In the case of output variables, the variable setting function sets the value of the output data to
the value of the physical data and the value of the data status to the logical data status.
Variable value setting Variable value setting
b y
Output variable

x y
b a
...
Locked status
Output module
Variable value setting Variable value setting
b y
Error Output variable Error

x x
a a
...
...
Unlocked status
A080202E.ai
Figure Setting Values for Output Variables
The logical output data is always updated with the value calculated by the application logic.
The value of the physical data, on the other hand, is fixed to the set value because the
physical data and the logical data are disconnected. The value fixed for the physical data
is actually output to the output channel. Note that only values in a range of -17.19 to 118.75
(%) can be set for output variables connected to AO modules. Any attempt to set a value
outside this range generates an error.
The physical data status is always updated with the value actually input from the output
channel. The value of logical data status, on the other hand, is fixed to the set value
because the physical data and the logical data are disconnected. In the application logic, the
value fixed for the logical data is used, rather than the actual input value.
When changing the data status or data value, an error will occur and the value cannot be
changed.

l Value Setting Operation upon Output Channel Error
If the case of an output channel error, the SCS locks the physical output data to the fail-safe
value and the output is placed in the Output Disable status. Therefore, even if you lock the output
variable corresponding to the error channel and set a desired physical data value using the
variable setting function, the set value will be automatically overwritten by the fail-safe value.
Once the output channel returns to normal, you can set a desired physical data value.
If the following settings are effective in the I/O Parameter Builder, however, you can lock the
output variable corresponding to the error channel and set a desired physical data value:
DO module: [Output Value in Detecting Error] is set to [Hold].
AO module: [Output Processing at Fault] is set to [Hold].
n Setting Values for Internal Variables

In the case of internal variables, the variable setting function sets a value for logical data.
Internal variable y
x y
Locked status

Internal variable y
Error
x x
Unlocked status (Security Level 1)

A080203E.ai
Figure Setting Values for Internal Variables
The physical data is always updated with the value written from application logic. The logical
data, on the other hand, is fixed to the set value because the physical data and the logical
data are disconnected. The value set for the logical data can be obtained by reading the
value of the variable.
When the SCS security level is Level 1, an attempt to set a value will result in an error, the
value cannot be changed. While, if the SCS security level is Level 0, setting a value will
not trigger any error. However, since the values of the internal variables in the logic are
constantly overwritten by newer values, lock the variables before setting values.
n Notification of Operation Result via Diagnostic Information Messages

If a variable value is set, the operation performed and the results of the operation are notified as a
diagnostic information message.
SEE
21E)

<A8.3 Forcing Function Block Parameters> A8-10
A8.3 Forcing Function Block Parameters

The function block parameters can be forced for debugging the applications. The ranges
can be forced in the user-defined function block is different from the other function blocks
(hereinafter referred to as standard function blocks). Moreover, the range for the user-
defined function blocks varies depending on whether the instance name is assigned or
not.
n Forcing User-Defined Function Block Parameters

For a user-defined function block, if the SCS security level is below Level 1 and the instance
parameters are locked, the data values can be changed.
On Multi-Language Editor, when a user-defined function block is selected and opened from
a program POU, the function block window can be displayed. On the window, any selected
parameter can be locked and the data value can be changed.
The locks applied to the parameters, same as the input/output variables and the internal
variables, cannot be released from the Multi-language Editor. However, the locks can be
released from Dictionary View.
In the program POU, if an instance in the user-defined function block is not assigned with an
instance name, the parameter of the instance cannot be locked and the data value cannot
be changed either.
However, if the SCS security level is Level 0, the data value can be changed anyway regardless
if the parameter is locked or not.
n Forcing Standard Function Block Parameters

When the SCS security level is Level 0, the function block parameters can be changed if the
parameter is not locked.
Only the parameter values of the standard function blocks that the instances are assigned
with instance names can be changed.
The parameter values of the standard function blocks can be changed from Dictionary View,
but cannot be changed from Multi-Language Editor.
Moreover, when the SCS security level is Level 1, the parameter values of the standard function
block cannot be changed. And the standard function block parameters cannot be locked
regardless security levels.

<A8.3 Forcing Function Block Parameters> A8-11
n Forcing Scope and Function Block Type

What parameters of different type of function blocks can be forced is shown in the table below:
Table Forcing Scope and Function Block Type
FB with Instance Name FB without Instance Name
Target/SCS Target/SCS
Type Logic simulator Logic simulator
simulator simulator
MLE(*1) DIC(*2) MLE(*1) DIC(*2) MLE(*1) DIC(*2) MLE(*1) DIC(*2)
Basic data type Parameters of
B A B A D C
User-Defined FB
User-Defined Parameters of
User-Defined FB in another user-
B A B A D C
defined FB (Local Parameters with
Defined Names)
User-Defined FB in another user-
D C D C
defined FB (Local Parameters
without Defined Names)
Standard FB in another user-
D C
defined FB (Parameters with
Defined Names)
Standard FB in another user-
defined FB (Parameters without
Defined Names)
Parameters of Standard FB D C
A: Allowed to lock, unlock and set data
B: Allowed to lock and set data but not unlock.
C: Allowed to set data only.
D: Allowed to set data only when SCS Security level is Level 0.
Blank: Not allowed to lock, unlock and set data.
*1: MLE: Multi-Language Editor

*2: DIC: Dictionary View
TIP
When using a forcing function for a parameter without name or an instance without instance name, the variable
name column of the diagnostic information message will indicate its internal name assigned in the SCS Manager.

<A8.4 Forcing of Inter-SCS Safety Communication> A8-12
A8.4 Forcing of Inter-SCS Safety Communication

It is possible to force inter-SCS safety communication data from the Inter-SCS
Communication Lock window of SENG. Inter-SCS safety communication data can be
forced when the SCS security level is 1 or 0.
IMPORTANT
Forcing of inter-SCS safety communication data can be performed only from the Inter-SCS
Communication Lock Window. Do not perform forcing operations (lock operation, referencing
lock status, value setting) on function blocks related to inter-SCS safety communication from the
Dictionary View. Performing lock operation from the Dictionary View causes a communication
error.
SEE
ALSO For more information about the Inter-SCS Communication Lock window, see the following:
2.3, Inter-SCS Communication Lock Window of the Utilities and Maintenance Reference (IM 32S04B20-
21E)
n Overview of Forcing of Inter-SCS Safety Communication Data

Forcing of inter-SCS safety communication data can be performed only from the Inter-SCS
Communication Lock Window.
It is possible to force outputs from function blocks on the producing side and the consuming
side of inter-SCS safety communication.
By locking the local SCS, all the data to be sent by the local SCS is locked at the same time.
It is not possible to lock specific receiving stations selectively.
Data received by consumer inter-SCS safety communication function blocks of the local
SCS can be locked collectively for the selected producing SCSs.
Values can be set only for inter-SCS safety communication function blocks of locked
stations. Data values can be set for the producer function blocks. For the consumer function
blocks, data values and status can be set. Value settings can be performed for individual
inter-SCS safety communication function blocks. In SCS simulation tests, it is possible to set
values for multiple function blocks at the same time.

The overview of forcing of inter-SCS safety communication is shown below.
Example: Function blocks on the producing side
SENG SCS0101
SCS project of Producing side function block
SCS0101
Inter-SCS Communication Logical data Physical data
Lock Window Application logic Binding data
Data value Data value
ng
Lock
tti
se
SCS0101
e
lu
Va
Lock
Inter-SCS safety
Control bus
communication
SCS0102
Consuming side
Application logic Binding data
function block
Example: Function blocks on the consuming side
SENG SCS0101
SCS project of
SCS0102 Producing side
Inter-SCS Communication function block
Lock Window
Lock
SCS0101
Control bus Inter-SCS safety
communication
SCS0102
Consuming side function block
Va
lue Logical data Physical data
set
ting
Data value Data value
ing Status Status
sett
Value
Lock
A080402E.ai
Figure Overview of Forcing of Inter-SCS Safety Communication

n Locking and Value Setting on Function Blocks on the Producing side

Select and lock the local SCS in the Inter-SCS Communication Lock Window to lock all function
blocks on the producing side of the local SCS.
l Locking Function Block on the Producing side

If a function block on the producing side is locked, the value of the IN parameter is not written to
PD (Physical Data), but written only to LD (Logical Data).The OUT parameter outputs the PD
value. Thus, the value before locking is output to the binding variable while the function block is
locked.
IN PD Data
OUT
Safety
information
LD
Input values are written only to The value stored in PD is set to the
LD if the function block is locked. value of the binding variable.
A080403E.ai
Figure Locking Function Blocks on the Producing side
l Value Setting on Function Blocks on the Producing side

If a value is written to a locked function block on the producing side from the Inter-SCS
Communication Lock Window, the value of PD (Physical Data) of the function block on the
producing side is overwritten with the specified value and output from the OUT parameter, which
is then written to the binding variable. It is not possible to overwrite the data for guaranteeing the
communication quality ("Safety information" in "Figure Locking Function Blocks on the Producing
side") via value setting.
When the value setting succeeds, the diagnostic information message (No. 4185) is output, and
you can check the values before and after the change.

n Locking and Value Setting on Function Block on the Consuming side

If you select and lock the SCS sending to the local SCS from the Inter-SCS Communication Lock
Window, the consumer function blocks in the local SCS that correspond to the locked SCS are
locked.
l Locking Function Block on the Consuming side

If a function block on the consuming side is locked, the value of the IN parameter connected to
the binding variable is not written to LD (Logical Data), but written to PD (Physical Data).The OUT
and NR parameters output the LD value. Thus, the value before locking is output from the OUT
and NR parameters while the function block is locked.
Error LD
Data
IN check OUT OUT
Safety information processing NR
NR
PD
OUT
NR
The values of OUT and NR The value stored in LD is

are written only to PD if output to OUT and NR.
the function block is locked.
A080403J.ai
Figure Locking Function Blocks on the Consuming side
If a function block on the consuming side is locked, only the status of LD (Logical Data) is passed
to the application logic that is connected to the function block on the consuming side. For this
reason, if an error occurs on the communication path while the function block is locked, it is not
possible to detect the error with the application logic. Note that errors on the communication
path detected by the function block on the consuming side are notified via diagnostic information
messages even while the function block is locked. The error status is output correctly from CMER
of the SYS_DIAG function block.
l Value Setting on Function Blocks on the Consuming side

If a value is written to a locked function block on the consuming side from the Inter-SCS
Communication Lock Window, the value of LD (Logical Data) of the function block on the
consuming side is overwritten with the specified value and output from the OUT and NR
parameters.
When the value setting succeeds, the diagnostic information message (No. 4185) is output, and
you can check the values before and after the change.

<A8.5 Applications of the Forcing Function> A8-16
A8.5 Applications of the Forcing Function

The forcing function is used in SCS maintenance and application debugging.
In application debugging, the forcing function is used for the following purposes:
Setting the variable and the function block parameter values for debugging the
application logic
Locking input/output modules
Locking input/output channels for wiring tests
Locking for the purpose of inter-SCS safety communication tests (producing or
consuming sides)
In SCS maintenance, the forcing function is used for the following purposes:
Locking input/output variables for all channels of each input/output module if
the required input/output module is not available or the field wiring has not been
completed
Locking input/output variables for all channels of each AIO/DIO module when
channels of the AIO/DIO module are faulty and the module has to be replaced
Locking input/output modules to prevent nuisance tripping during online
modification of input/output modules
Locking input/output channels for maintenance
Locking input/output channels to prevent nuisance tripping during online
modification of application logic
Locking function blocks on the producing or consuming sides to prevent nuisance
tripping due to error occurrence in inter-SCS safety communication during online
change download and off-line download
The forcing function can be used in target tests, SCS simulation tests and logic
simulation tests. However, the I/O Lock Window, SCS Link Transmission Lock Window
and Communication I/O Lock Window cannot be used for the logic simulation tests.
A8.5.1 Application Debugging

The forcing function is used for the following purposes after creating an application, from
the start of debugging until the completion of all wirings.
Debugging the application logic
Locking input/output modules
Locking input/output channels for the purpose of wiring tests
Locking function blocks on the producing or consuming sides for debugging inter-
SCS safety communication
n Debugging Application Logic

If you lock variables, you can change values such as input data and function block parameter. As
a result, debugging application logic can be performed on different conditions.
n Locking Input/Output Modules

Variables can be locked for all channels of each input/output module if the required input/output
module is not available or the field wiring has not been completed, thereby preventing the
application logic from being influenced by input data and data status changes of input/output
channels. It is also possible to lock all the variables of multiple input/output modules in one
operation.

n Locking Input/Output Channels for the Purpose of Wiring Tests

By locking input variables, it is possible to conduct wiring tests on the input side (field wiring/
device) without transmitting changes of values of the input channels and conditions on the input
side to the logic side. The actual input values can be checked in the I/O Lock window.
Similarly, by locking output variables, it is possible to conduct wiring tests on the output side
without transmitting changes of the values of the logic side to the output channels. In this case,
the operation on the output side can be checked by changing the values of the locked output
variables.
Each module/all modules (*1)
Input variables Output variables

Module not connected Module not connected
Output module
Input module
internal variable
Logic Logic
internal variable (*4)
Output module
Input module
Input channel (*3)

Output channel (*5)
Input channel (*2) : Locked variables
A080401E.ai
*1 Disconnection of AIO/DIO module

*2: Input field wiring test
*3: Logic debugging by changing input data
*4: Logic debugging by changing internal variable
*5: Output field wiring test
Figure Applications of the Forcing Function
n Locking for Debugging Inter-SCS Safety Communication

It is possible to lock and set values for function blocks using the Inter-SCS Communication Lock
Window in order to debug inter-SCS safety communication applications. By locking either the
producing or consuming side function blocks and setting values for individual function blocks, it is
possible to change the execution conditions of application logics for debugging.

A8.5.2 Utilization of the Forcing Function in SCS Maintenance

The forcing function can be used for the following purposes, after all wiring is completed
but before the start of actual operation, as well as during maintenance after starting the
actual operation.
Disconnection of input/output modules
Maintenance of input/output channels
n Disconnection of Input/Output Modules
l Prevention of Nuisance Tripping when Replacing a Faulty Module

If a channel of the input module fails in single configuration, the replacement of input module is
required. The forcing function is used to fix input values of all channels to the current values to
prevent nuisance tripping.
Similarly, if a channel of the output module fails in single configuration, the replacement of output
module is required. The forcing function is used to fix the data status of all channels of the output
module to the current values to prevent nuisance tripping in other output modules that refer to this
channel.
l Prevention of Nuisance Tripping due to Online Modification

When changing the application logic or input/output modules online, the forcing function is used
to fix output values of all channels that may be influenced by this change, in order to prevent
nuisance tripping.
In online modifications of an input/output module online, the forcing function is used to fix the
input/output values of all channels of the corresponding input/output module to the current values
in order to prevent nuisance tripping.
WARNING
It is necessary to bypass the field control signals and separate them from the output
modules so as to prevent plant shutdown.
In online modifications of output modules, if the channel status of the module is used as a
reference by another output module, the channel of another output module may mistakenly
generate a trip signal. To prevent this, the output modules linked to the online-changed
module should be locked during online maintenance.
SEE
ALSO For more information about whether to lock or unlock the inputs or outputs, see the following:
(D) (D) On-line Change Download in Procedure for On-line Change of an Application in 5.1, Entire
Procedure of On-line Change of Application of the Engineering Guide (IM 32S01C10-21E)

n Maintenance of Input/Output Channels

When performing maintenance of input/output channels, the forcing function is used to fix the
values of the corresponding channels so as to prevent adverse effect on the operation of other
applications.
n Prevention of Nuisance Tripping Due to Inter-SCS Safety

Communication Errors at Download
Nuisance tripping due to inter-SCS safety communication errors can be prevented by locking
inter-SCS safety communication when performing online change download and off-line
download.
WARNING
Be sure to check that LD (Logical Data) and PD (Physical Data) match when unlocking after the
completion of download operation. Unlocking in the status where LD and PD do not match may
cause nuisance tripping.
l At Online Change Download

In the case of online change download, launch the Inter-SCS Communication Lock Window
from an SCS project in which online change download is to be performed, and then lock stations
on the producing and consuming sides. Nuisance tripping caused by online changes can be
prevented.
l At Off-line Download
In the case of off-line download, launch the Inter-SCS Communication Lock Window for an SCS
project receiving data from the SCS which will perform off-line download (e.g., SCS0101), and
then lock SCS0101 so as to lock the function block on the consuming side. Nuisance tripping
caused by off-line download can be prevented.

<A9. Connection with Other Systems> A9-1
A9. Connection with Other Systems

The SCS provides the following functions to permit connection with other systems.
Modbus slave connection
Subsystem communication
SEE
ALSO For details on Modbus slave connection, see the following:
B1, Modbus Slave Connection of the Open Interfaces (IM 32S05B10-21E)
For details on subsystem communication, see the following:
Part C, Subsystem Communication Interfaces of the Open Interfaces (IM 32S05B10-21E)

<B1. What is RAS (Reliability, Availability and Serviceability) of SCS?> B1-1
B1. What is RAS (Reliability, Availability

and Serviceability) of SCS?
This chapter explains functions related to reliability, availability and serviceability of SCS
(hereinafter referred to as RAS in this manual). It also explains each function that provides
the actual safety. The function includes the ability to shift to a safe state in a fast and
reliable manner when an error occurs in the plant or system. Among these factors, the
following items are explained:
Operating mode
Diagnostic management function, diagnostic information messages
IOM Report
Specifications at startup
Actions taken at error occurrence and recovery procedure
Dual redundancy
SEE
ALSO For the security management function of the SCS, see the following:
2.12, Security of the Engineering Guide (IM 32S01C10-21E)
For the operations to set SCS security levels, see the following:
1.3, Security of SCS of the Utilities and Maintenance Reference (IM 32S04B20-21E)
n RAS Functional Relation

RAS stands for Reliability, Availability and Serviceability, and is an important index when
evaluating the system performance. Reliability means robustness against error occurrence,
availability means shortness of downtime and serviceability means ease of repair at failure.
l Functional Relation of Software

The RAS function diagnoses whether hardware and software are running normally and handles
maintenance of them if any errors are detected. Since this function is able to shut the system
down and change the SCS status as required, it is one of the most essential SCS functions.

<B1. What is RAS (Reliability, Availability and Serviceability) of SCS?> B1-2
l Relationship with Other Hardware
The RAS function collects hardware error information concerning the I/O modules and other
components in the station. The RAS function organizes hardware error information and executes
pre-defined safety operations accordingly, such as shutting down. Error information is sent to
the SENG and HIS as diagnostic information messages. The SCS saves diagnostic information
generated internally. And the information can be referenced from SENG. You can delete saved
diagnostic information messages from SENG.
The figure below shows how the RAS function of the SCS is positioned.
SENG HIS
V net
Diagnosis
System Alarms
Information
Download,
Changing
SCS FCS
Actions
RAS
funciton
Error I/O module

Information shutdown
Input/output
modules
B010001E.ai
Figure Positioning of RAS Function

<B2. Operating Mode> B2-1
B2. Operating Mode

The operating mode indicates the operation status of an SCS. Operations of system of the
SCS are determined by the operating mode.
The SCS operating mode can be one of the following five types: Stop mode, Loading
mode, Initial mode, Waiting mode and Running mode. Each of these modes is explained
in details.
n Overview of Operating Mode of SCS

The operating mode indicates the operating status of the SCS. The operations of each function
executed by the system program of SCS are determined by the operating mode. An overview of
the operating mode is provided below.
The operating mode indicates the overall operating status of SCS, not the status of each
output module.
The operating mode indicates the status of a single SCS, regardless of whether the
configuration of CPU of SCS is single or dual-redundant.
If CPU of SCS is dual-redundant, the operating mode does not shift even if the control right
of CPU is switched.

l Diagram of Operating Mode State Transition
The figure below illustrates how the operating mode shifts. Note that it is possible to shift to the
Stop mode from all other modes, but the arrows indicating these shifts are omitted for the sake of
clarity.
Loading
Mode
The request of Finish of

Off-line Download Off-line Download
start from notified from
SCS Manager SCS Manager
The application-logic execution All output channels of safety

The SCS starts upon function starts upon output modules are
a start request. completion of Output Enabled
diagnosis.
Stop Initial Waiting Running
Mode Mode Mode Mode
At least one
output channel of
a safety output module is
Output Disabled .
SCS Power ON
Can be transferred
from all other modes
SCS stopped
B020001E.ai
Figure Operating Mode Status Shift
n Stop Mode (Stopped Status)

This is the initial state of the SCS.
n Loading Mode (During Off-line Download)

In this mode, program and database are being downloaded from the SCS Manager to the SCS.
n Initial Mode (Initializing Status)

In this mode, the SCS is initializing databases, processing the diagnostic at startup and starting
the input/output modules, all of which are necessary following an initial cold start. If started
successfully, input modules set input values in the applicable input variables. If the startup of any
input module has failed, an error is recognized for the module. With output modules, the outputs
of all channels remain disabled even after the startup is completed, so that the output values
from the application logic will not be output to the field immediately. Subsystem communication
modules communicate the inputs only, while their outputs remain disabled.

n Waiting Mode (Waiting for Output Enable Request)

Application logic is periodically executed on each scan period. Howerer, if the status of an output
channel is set to Output Disable, the result of the application logic will not be output actually.
Failure on the output channel should be removed, and perform Output enable operation.
If you execute the Output enable operation just after starting up the SCS, the SCS also
enabls the output of inter-SCS safety communication, SCS Link Transmission and subsystem
communication. The Waiting mode status can be checked in the SCS State Management
Window and the LED display of the CPU module.
n Running Mode (Controlling Status)

This mode indicates that the SCS is running normally. All output channels of safety output
modules are outputting the output values from the application logic. The Running mode status
can be checked with the SCS State Management Window and LED display of the CPU module.
l Output Status Monitoring

All output channels of safety output modules are monitored. If any of the channels becomes
Output Disable status due to a failure in the corresponding module or in the output channel itself,
or after adding new channels during online modification, the SCS will change its operating mode
to the Waiting mode. The operating mode changes to the Running mode when the cause of the
channel failure is removed, the output enable operation is completed and all output channels are
placed in the Output Enable status.
n Checking of Operation Mode

The operating mode of SCS can be checked with the following methods.
It is possible to check that the operating mode is either the Waiting or Running mode with
the SCS State Management window of the SCS Maintenance Support Tool, the SCS Status
Display view of HIS and the LED display of a CPU module.
If the operating mode is either the Waiting or Running mode, the operating mode can be
referenced from the application logic as well.

n Influence on Operating Mode

Engineering and occurrence of errors can affect the operating mode as follows.
Occurrence of errors in sub-system communication and communication modules has no
influence on the operating mode.
Occurrence of errors in SCS link transmission has no influence on the operating mode.
If output modules/channels are added via online changes, the added modules/channels
are started from the Output Disable status. If the operation mode was the Running mode
before online changes, the mode changes to the Waiting mode. Perform the output enable
operation.
If channels in the Output Disable status or output modules including such channels are
deleted via online changes and there are no longer any channels in the Output Disable
status in SCS, the operating mode shifts from the Waiting mode to the Running mode.
If a single output module is changed to dual redundant configuration by online change
download, IOM download is executed in order to initialize the modules. The outputs of the
target modules become disabled after downloading. Since some channels are in the Output
Disable status, the operating mode of SCS shifts to the Waiting mode. Perform the output
enable operation after the output modules recover to normal.
It is possible to perform the output enable operation regardless of the status of
communication modules.
It is possible to perform the output enable operation even if the status of communication with
sub-systems is BAD. In this case, only outputs that are ready to communicate will start.

<B3. Diagnostic Management Function and Diagnostic Information Message> B3-1
B3. Diagnostic Management Function

and Diagnostic Information
Message
An SCS detects hardware and software errors by self-diagnosis. Moreover, it notifies and
saves diagnostic information using the diagnostic management function. This chapter
explains the diagnostic management function of SCS.
n Overview of Self-diagnosis of SCS and Diagnostic Management

Function
An SCS performs self-diagnosis regularly to detect hardware and software errors. It analyzes
detected errors and system configuration to determine the error level according to the error
occurred and executes error-handling operations according to the error level.
The diagnostic management function saves/manages diagnostic information messages
generated by self-diagnosis and manages the SCS status. Moreover, it notifies the operation
status of the SCS to the SENG and HIS.
n Functional Relation of Diagnostic Management Function

The figure below illustrates the flow of error information detected by an SCS diagnostic functions.
Error information is composed of status information indicating faulty locations/error causes
and diagnostic information messages used to notify the user about the errors. In the case of
a CENTUM integration structure, the HIS treats diagnostic information messages as system
alarms.
SENG HIS
SCS Diagnostic
Diagnostic System alarm display
Information Operation
information
SCS Status Display SCS Status Display
Diagnostic
SCS status information
SCS status message
SCS
Diagnostic
information Diagnostic
Error information management function
Status Processings Status
Self-diagnosis
Diagnosis
IOM FAULT
B030001E.ai
Figure Functions Related to SCS Error Information and Flow of Information

<B3.1 Diagnostic Management Function of SCS> B3-2
B3.1 Diagnostic Management Function of SCS

An SCS performs the following processing with its diagnostic management function.
Saves diagnostic information messages in the SCS memory
Notifies error information in response to requests from windows dealing with
diagnostic information
Acknowledges and deletes diagnostic information messages in response to requests
from windows dealing with diagnostic information
SEE
ALSO For more information about manipulation of diagnostic information messages from SCS Maintenance Support
Tool of SENG, see the following:
21E)
n Management of Diagnostic Information

An SCS manages diagnostic information in the following manner.
The SCS saves diagnostic information messages it sends in its memory as diagnostic
information. It sends the saved message information in response to requests from SENG
windows that handle diagnostic information.
The buffer in the SCS that stores diagnostic information message has the capacity limit.
In order to save all diagnostic information messages, it is necessary to collect diagnostic
information messages from the SENG. The SCS can save up to 5000 diagnostic information
messages. If the SCS buffer becomes full, diagnostic information messages are deleted
starting from the oldest one.
In the event of power failure, the SCS saves the latest diagnostic information to a memory
backed up by a battery. It will restore the saved information upon restart.
n Notification of SCS Diagnostic Information

The diagnostic management function notifies SCS diagnostic information in response to requests
from windows that handle diagnostic information. This allows checking and manipulating the
information from the SENG and HIS.
It is possible to check diagnostic information for each failed part from the Diagnostic
Information Window of the SENG.
It is possible to acknowledge/delete diagnostic information messages from the Diagnostic
Information Window of the SENG.
It is possible to see diagnostic information as a list of system alarm messages in SOE
Viewer of the SENG and HIS.
It is possible to check the state of the SCS, including how the CPU module is operating in
the SCS Report dialog box of the SCS State Management Window of the SENG.

<B3.1 Diagnostic Management Function of SCS> B3-3
n Notification of Diagnostic Information to Function Blocks

System status function blocks notify errors that are detected by the system diagnosis. As a result,
you can make an application logic that uses the diagnostic information as reference and takes
action when errors occur.
SEE
ALSO For more information about system status function blocks, see the followings:
For Safety system function blocks, see the following:
C9. Safety System Function Blocks
For interference-free system function blocks, see the following:
C10. Interference-free System Function Blocks

<B3.2 Notification of Diagnostic Information Messages> B3-4
B3.2 Notification of Diagnostic Information

Messages
When an SCS detects an error, an error level is assigned to that error. SCS generates the
diagnostic information message for that error level to notify you of the occurence of the
error. You can view the diagnostic information messages on the HIS and SENG. If a fatal
error occurs, the CPU stops; in this case, some diagnostic information messages may not
be sent.
n Error Levels and Diagnostic Information Messages

SEE
ALSO For details on SCS error levels, see the following:
2.10, Diagnosis Function of SCS of the Engineering Guide (IM 32S01C10-21E)
The table below summarizes the diagnostic information messages and error notifications to the
application logic corresponding to different levels of errors that may generate in the SCS.
Table Error Levels and Notifications of Diagnostic Information Messages
Error level Diagnostic information message Notification to application logic
Diagnostic information message may not be Notification is not possible because the CPU is
Fatal error
notified because the CPU stops. stopped.
The failure location, cause of error and other
Major error The error and output status is notified.
information are notified.
A representative error state is notified, instead
The failure location, cause of error and other
Minor error of an individual error state. An application logic
information are notified.
that utilizes this notification can be created.
SEE
ALSO For details on actions taken at error occurrence, see the following:
B6, Actions Taken at Error Occurrence and Recovery Procedure

<B3.2 Notification of Diagnostic Information Messages> B3-5
n Diagnostic Information Messages

Failures of devices and SCS operation information are notified to the user as diagnostic
information messages. The user can obtain information about the time and location of the error
occurrence as well as the error type from the messages.
The SCS adds information of the alarm class based on the error level when sending a
diagnostic information message. The SENG displays messages with color according to the
alarm class.
Table Alarm Classes

Correspondence
Alarm class Meaning of alarm class Example
with error level
An error that may cause system
Fatal error (*1) Error notification of IOM in single
Class 1 (serious alarm) shutdown occurs and immediate
Major error configuration.
action by the user is required.
Notification of a error of an IOM
on one side of the redundant
Notification that requires prompt
configuration
action by the user, such as hardware
Notification of variable lock
Class 2 (minor alarm) Minor error replacement and remedy of user
status by the forcing function
operation mistakes although the
continuing for longer th an the
functions for safety continue to work
specified time
Alarm sent by the HKU
Class 3 (light alarm) Notification of recovery from an error
Class 4 (notification Notification of status other than SCS Notification of change of the
alarm) errors to the user security level
*1: Because the CPU stops when a fatal error occurs, the system may fail to generate a diagnostic information message that
indicates the error.
The time displayed in a diagnostic information message is the time when the SCS detected
an error. The minimum unit of time is millisecond.
The time information set for an diagnostic information message has the same high accuracy
as the time information set for SOE information.

<B4. Notification of Diagnostic Information using the IOM Report> B4-1
B4. Notification of Diagnostic

Information using the IOM Report
This chapter explains the following items regarding the diagnostic information relating
to AIO/DIO modules and communication modules that are displayed in the IOM Report
dialog box called from the SCS Maintenance Support Tool.
Format of diagnostic information displayed in the IOM Report dialog box
Details of diagnostic information displayed in the IOM Report dialog box
SEE
ALSO For IOM Reports on serial communication modules, see the following:
B4.2, IOM Report of Serial Communication Modules
n Calling the IOM Report

In the Hardware Configuration Tree View within the SCS State Management Window of the SCS
Maintenance Support Tool, select an input/output module and click the System Report button
on the tool bar; the IOM Report dialog box appears.
SEE
ALSO For the structure and operation of the IOM Report dialog box, see the following:
3.1.3, System Reports of the Utilities and Maintenance Reference (IM 32S40B20-21E)

<B4.1 IOM Report of AIO/DIO Modules> B4-2
B4.1 IOM Report of AIO/DIO Modules

This section explains the IOM Report of analog input/output modules and discrete input/
output modules. In this section, AIO/DIO modules are referred to as input/output modules.
n Display Content in the IOM Report

The IOM Report displays the diagnostic information regarding input/output module errors. The
input/output module errors are categorized and displayed as follows:
Cause of the input/output module error
This is a display of the input/output module error status detected by the CPU module of the
SCS. The input/output module status as viewed from the CPU (such as No response and
HRDY OFF) and other information are displayed. The detailed cause of the input/output
module failure is displayed under Error information inside the input/output module.
Error information inside the input/output module
Causes of an error and a recovery are collected from the input/output module, and then
displayed.
Cause of the channel error
Channel error status is displayed. IOP errors detected by the CPU module and channel
errors detected by the input/output module are displayed. If an IOM module becomes error
due to an error in an I/O channel, multiple error messages regarding the channel of the I/O
module maybe displayed.
TIP
If a bus error occurs between the input/output module and the CPU module, the CPU of the SCS will detect a
No response error with the input/output module. In such a case, this will be treated as a host side (such as the
CPU, bus between the CPU and the input/output module) failure in the input/output module. If the input/output
modules give no response to the CPU, the CPU cannot collect the error information from the input/output module.
However, once the input/output module recovers from this state, the cause of the input/output module error (No
response) detected by the CPU and the error information inside the input/output module (fallback due to the host
side error) will be displayed so that the cause of the error can be identified.
Note also that if there is an input/output module failure, HRDY OFF will be displayed as the cause of the input/
output module error detected by the CPU of the SCS, and the cause of the failure can be identified based on the
Error information inside the input/output module.

n IOM Report Display Format

The IOM Report is displayed in the following format.
I/O Module :
Node :2
Slot :1
Type : SAI143S
IOM Model : SAI143-S03 S1U0H00-F00-
Serial No : XXXXXXXX
(Current status) : (Current error information (CPU detection))

First Error Code : (Information for first error)
Last Error Code : (Error information at recovery)
(Error information inside the input/output module)
Channel
1 : (Channel status) (The latest channel error)
(Cause of the channel error detected by the input/output module)

(4 Kbyte dump display)

l An Example of I/O Module Error
This is the explanation of the example of the IOM Report that appears when you select a module
and call it under the following circumstance.
Time T1 Time T2 Time T3
Input/output module
status as viewed IOM normal
IOM normal Error A Error B Error C
from the CPU (IOM recovered)
(Current status)
Error A Error C
First Error Cause 0 (Time of occurrence T1) (Time of occurrence T3)
Last Error Error B

Cause 0 Not displayed Not displayed
(Time of recovery T2)
Pattern Pattern Pattern Pattern

(1) (2) (3) (4)
B040101E.ai
Figure Input/Output Module Error
The following information will be displayed in each of the situations shown in the figure.
Pattern (1)
This is a state where there is no input/output module error after the initial cold start of the
CPU. In this case, the current status (normal) will be displayed. The first and last error code
lines will display the time when the input/output module was started and the cause (Cause
0), respectively.
Pattern (2)
This is a state where there is an input/output module error. The current status and the
current error content, as well as the time of the first error occurrence (T1) and the first error
(Error A), will be displayed. The last error will not be displayed. (The last error code line will
not be displayed.)
Pattern (3)
This is a state where the input/output module has recovered from the error. The current
status (normal), the time of the first error occurrence (T1), the first error (Error A), the time of
recovery (T2), and the last error (Error B) will be displayed.
Pattern (4)
This is a state where there is an input/output module error. The time of the first error
occurrence (T3) and the first error (Error C) will be displayed.

l Display Format Details (I/O Module Details)
Cause of the input/output module error and error information inside the input/output module are
displayed in the following format.
Table Cause of the Input/Output Module Error and Error Information inside the Input/Output Module
Display item Description
The current IOM status will be displayed in the following format.
Current status
IOM Normal/IOM Fail/IOM Fail (Output Shutoff)
The cause of the current input/output module error detected by the CPU will be
displayed with error code.
Current error information
Example: No response (0x0000 5101)
(CPU detection)
Display condition: The information is displayed when there is an input/output
module error.
The time of the first error occurrence detected by the CPU (when the input/output
module status changed from normal to error) and the error information will be
Information for first error
Example: 20/4/2005 12:34:56 IOM Fail (HRDY OFF) (0x0000 5105)
Display condition: The information is displayed when an error occurs with the input/
output module even once.
The recovery time of the I/O module and the latest error information will be
Error information at
Example: 20/4/2005 12:50:56 IOM Restart (0x0000 5106)
recovery
Display condition: The I/O module is currently normal and the displayed information
is the latest error in the past.
How the input/output module was started and the error code inside the input/output
module will be displayed.
Example 1: When the input/output module is normal
IOM Start: IOM Restart (Power On) (0x0301 5547)
Error information inside
Example 2: When there is an input/output module error
the input/output module
IOM Fail: IOM Readback Error (0x0101 5502)
Display condition: The information is displayed when the cause of the error is stored
inside the input/output module, and the input/output module information can be
obtained.

l Display Format Details (Channel Details)
The details of a channel error will be displayed as follows:
Table Cause of the Channel Error
Display item Description
The current channel status will be displayed. If the I/O module is dual-
redundantly configured, the channel status on the control side module will
Channel status be displayed.
- (When the channel is not in use) / Normal / IOP+ / IOP- / TRNS+ / TRNS-
/ Ovr Range / Ch Fail
This part displays the time that the channel recovered from the error
and the latest error information. If the I/O module is dual-redundantly
The latest channel error (*1) configured, the latest error on the control side module will be displayed.
This item is displayed only when the channel status is normal.
Example: Normal (21/6/2005 12:50:56 Last Error: IOP+)
The last-saved channel error in the I/O module will be displayed. If multiple
errors are kept in the I/O module, the multiple errors may be displayed.
Cause of the channel error
Even if the I/O module is in dual-redundant configuration, the error of the
detected by the input/output
module will be displayed anyway.
module (*2)
Example : Open Circuit (0x0401 5561)
Short Circuit (0x0401 5562)
*1: The channel status during IOM Failure is the status right before the IOM fails.
*2: If the IOM failure is caused by the abnormality of a channel, the error of the channel will be displayed in IOM Report.
Example 1: Channel Failed
1: IOP+
2: Ch Fail
Open Circuit (0x0401 5561)
Example 2: Channel Recovered
3: Normal (21/6/2005 12:50:56 Last Error : IOP+)
4: Normal (21/6/2005 12:50:56 Last Error : Ch Fail)
Open Circuit (0x0401 5561)
TIP
The channel status and the last error of a pair of dual-redundantly configurated input/output modules will be
collected from the active input/output module. If the input/output module is placed in a redundant configuration,
read the descriptions regarding the IOM Report of the active input/output module for details.

n Code System for Causes of Errors in the IOM Report

The display format and the code system in the IOM Report to indicate the causes of errors are as
follows:
l Display Format
Category of input/output module errors Category of causes of errors
l Code System for Category of Input/Output Module Errors

0x00XX
Error detected by the CPU
0x01XX
Input/output module hardware failure
0x02XX
Input/output module setting error (such as a disconnected connector on the field side)
0x03XX
Recovery from an input/output module error (such as when the input/output module was
recovered from 0x02 above, or recovered after the fallback operation was executed upon
detecting a host side error)
0x04XX
Channel error (In this case, there is an error with the applicable channel. It indicates a wiring
error or a channel hardware failure when the input/output module is in a single configuration.
If the input/output module is in a redundant configuration, the channel hardware failure will
be displayed as the category 0x01XX Input/output module hardware failure.)
l Code System for Category of Causes of Errors

0x51XX
Content of error detected by the CPU
0x55XX
Content of error detected by the input/output module (including cause of recovery)

n Cause of the Input/Output Module Error (CPU Detection)

The following explains the details of the codes used to indicate the cause of the input/output
module error detected by the CPU. The IOM Report will display these codes as Current error
information (CPU detection), Information for first error, or Error information at recovery.
Table Details of Codes for Cause of Input/Output Module Error (CPU Detection)
Code
Display Description
(Hexadecimal)
A no-response error has occurred during the communication
between the CPU and the input/output module.
0000 5101 No response
The error occurred is either with the input/output module or in
the communication path to the input/output module.
The model name of the input/output module defined in
the SENG does not match that of the input/output module
0000 5102 IOM model Code Error
installed.
Verify the model name of the input/output module.
The setting information defined in the I/O parameter builder
0000 5103 IOM Configuration Error does not match the input/output module setting information.
Perform IOM download.
An input/output module hardware failure has been detected.
An error occurred and the HRDY on the I/O module turned
0000 5104 IOM Fail (HRDY OFF) OFF.
Check the error information inside the input/output module for
the detailed cause of the error.
The error may have been generated because the connector is
disconnected and field power not supplied, or IOM download
I/O Error
0000 5105 was performed.
(AP READY-OFF)
Check the error information inside the input/output module for
The input/output module has recovered from the error state.
0000 5106 IOM Restart Check the error information inside the input/output module for
An error occurred and the Output Shutoff switch was activated
due to a reason other than output module failure (the HRDY
does not turn OFF).
0000 5107 Output Shutoff
Check the IOM Report for the detailed cause of the error.
If this type of error occurs, perform the output module start
operation after the cause of the error has been eliminated.
0000 5111 An error has been detected in the data check of the
communication between the CPU and the input/output
0000 5112 module.
Communication Error
This error may have been caused due to a failure with the
0000 5113 input/output module or the communication path between the
CPU and the input/output module.
0000 5114 An error has been detected in the redundant control part of
IOM Redundant Control
the input/output module.
0000 5115 Fail
Replace the input/output module.
An error has been detected in the input/output module.
0000 5116 Replace the input/output module.
However, if the IOM Error (0000 5117) occurred after the
IOM Error
IOM downloading or during the SCS restarts after off-line
0000 5117 downloading, there is no need to replace the input/output
module.

n Error Information inside the Input/Output Module

The following explains the details of the codes for the cause of error detected by the input/output
module in the channel common area of the input/output module, or in the channel area if the
input/output module is in a redundant configuration. The IOM Report will display these codes as
Error information inside the input/output module.
l Input/Output Module Hardware Failure

The following explains the details of the codes for hardware failure in the channel common area
of the input/output module, or in the channel area if the input/output module is in a redundant
configuration.
Table Details of Codes for Input/Output Hardware Failure
Code
Display Description
(Hexadecimal)
There has been a failure in the channel common area of the
01xx 5501
IOM Channel Common Fail input/output module.
(xx: Internal code)
An error has been detected in the readback process for the
output value.
Check the field wiring of the analog output module for any
0101 5502 abnormality, and also confirm that the total resistance of
0401 5502 Output Readback Error all connected cables and devices does not exceed the
(*1) allowable output load resistance of the output module as
specified in the GS (General Specification).
If the wiring and resistance are appropriate, replace the
output module.
0101 5503
An error has been detected in the channel power supply.
0401 5503 Internal Power Supply Fail
(*1)
0101 5504 A failure that cannot turn off the output has been detected.
0401 5504 Output Channel Failed ON Check if there are any field wiring errors. If there is no field
(*1) wiring error, replace the output module.
0101 5505 A failure that cannot turn on the output has been detected.
0401 5505 Output Channel Failed OFF Check if there are any field wiring errors. If there is no field
(*1) wiring error, replace the output module.
0101 5506
An overcurrent failure has been detected inside the input/
0401 5506 Over Current
output module. Replace the input/output module.
(*1)
01xx 5507
There have been some errors with the channel area of the
04xx 5507
IOM Channel Fail input/output module.
(xx: Internal code)
(*1) (*2)
*1: For a channel failure, the error codes and the statuses of failures vary depending on whether the input/output module is in the
redundant configuration or non-redundant configuration.
The upper error code is for a redundantly configured I/O module, while the lower error code is for a non-redundantly configured
I/O module.
If the input/output module is in a redundant configuration, this error will be an IOM Fail error. In a non-redundant configuration,
the error will occur only to the failed channel.
*2: Code xx07 5507 errors may occur upon input of a signal value at a level between ON and OFF or due to chattering.
SEE
ALSO For the allowable output resistance of the analog output module, refer to Analog I/O Modules (for ProSafe-RS)
(GS 32S06K30-01E).

l Input/Output Module Setting Error
The following explains the details of the codes for input/output module setting error.
Table Details of Codes for Input/Output Module Setting Error
Code
Display Description
(Hexadecimal)
Connector on Field Side The connector on the field side is disconnected. Check the
0201 5521
Disconnected connector.
There has been a voltage error with the field power supply.
Check if there are any errors with the field power supply
0201 5522 Field Power Supply Error
or the wiring. If there is no error, replace the input/output
module.
0201 5523 Execution of Download IOM download is being executed.
There has been an error with the transmitter power supply
inside the input/output module. Check if there are any errors
0201 5524 with the transmitter, the field wiring and the input/output
Transmitter Power Error
0401 5524 (*1) module setting. The error may have been caused because
the two-wire/four-wire setting of the current input module
and the pin setting of the input/output module do not match.
*1: For a channel failure, the error codes and the statuses of failures vary depending on whether the input/output module is in the
redundant configuration or non-redundant configuration.
The upper error code is for a redundantly configured I/O module, while the lower error code is for a non-redundantly configured
I/O module.
If the input/output module is in a redundant configuration, this error will be an IOM Fail error. In a non-redundant configuration,
the error will occur only to the failed channel.
l Recovery from Input/Output Module Error

The following explains the details of the codes for recovery from input/output module error.
Table Details of Codes for Recovery from Input/Output Module Error
Code
Display Description
(Hexadecimal)
Connector on Field Side The input/output module has recovered from the
0301 5541
Recover disconnection error of the field side connector.
The input/output module has detected an error in the
03xx 5542
Fallback communication with the host, and the fallback operation
(xx: Internal code)
was executed.
0301 5543 Field Power Supply Recover The field power supply has recovered to a normal state.
0301 5544 Download Completed IOM download has been completed.
0301 5545 IOM Switchover The control right was switched upon request from the host.
The Output Shutoff switch activated due to a cause other
than a failure in the output module (HRDY does not become
0301 5546 Output Shutoff OFF), and the outputs of all channels have become 0.
Check if there are any field wiring errors. If there is no field
wiring error, replace the output module.
0301 5547 IOM Restart (Power-On) The input/output module started after turning the power on.
The transmitter power supply has recovered to a normal
0301 5548 Transmitter Power Recover
state.

n Cause of the Channel Error

The following explains the details of the codes related to channel error. The IOM Report will
display these codes as Channel status, The latest channel error and Cause of the channel
error detected by the input/output module in the area where causes of channel errors are to be
displayed.
l Channel Status, The Latest Channel Error

Channel status in the IOM Report will display the channel status (cause of a channel error)
detected by the CPU. And the Latest Channel Error is the last error that CPU detected. The
details of the codes will be explained as follows.
Table Details of Codes for Channel Status
Code
Display Description
(Hexadecimal)
0000 5121 TRNS+ A transmitter high limit error has occurred.
0000 5122 TRNS- A transmitter low limit error has occurred.
0000 5123 IOP+ An input high limit error has occurred.
0000 5124 IOP- An input low limit error has occurred.
There has been an internal error that the analog input value
0000 5125
Ovr Range is out of the range between -25% and 125%. Replace the
0000 5126
input module.
A channel error has occurred. Check the display of cause
0000 5127 Ch Fail of the channel error detected by the input/output module for
the cause of the error.
l Cause of Channel Error Detected by the Input/Output Module (Input/Output

Module Detection and the Details of Channel Error)
Cause of channel error detected by the input/output module will display channel errors detected
by the input/output module. Details of the codes are explained.
Table Details of Codes for Cause of Channel Error Detected by the Input/Output Module
Code
Display Description
(Hexadecimal)
An error has occurred due to open circuit. Check the field
wiring. In SDV526, open circuit occurs due to a channel
0401 5561 Open Circuit
fuse burnout caused by a short circuit. Check the field
wiring and channel fuses.
An error has occurred due to short circuit. Check the field
0401 5562 Short Circuit
wiring.
Short Circuit between There is short circuiting between channels. Check if there
0401 5563
Channels are any field wiring errors.
An output overload has been detected. Check if there are
0401 5564 Output Overload
any errors with the field wiring or the loading device.
SEE
ALSO If the I/O module is non-redundantly configured, as for the cause of the channel error, error with code 04xx xxxx
explained in the Input/Output Module Hardware Failure section will be displayed as the cause of the channel error
detected by the input/output module.
For the cause of the channel error, see the following:
Input/Output Module Hardware Failure in Error Information inside the Input/Output Module

<B4.2 IOM Report of Serial Communication Modules> B4-12
B4.2 IOM Report of Serial Communication

Modules
This section explains the IOM Report on the following communication modules.
Serial communication modules (Modbus slave communication)
Serial communication modules (Subsystem communication)
n Display Format of IOM Reports on Serial Communication Modules

(Modbus Slave Communication)
The display format of IOM Reports when an ALR111 or ALR121 is used as a Modbus slave is as
follows:
I/O Module:
Node: 2
Slot: 6
Type: ALR111
IOM Model: ALR111-S03 S0U0H0-- F0--
(4-kbyte dump display)

n Display Format of IOM Reports on Serial Communication Modules

(Subsystem Communication)
The display format of IOM Reports when an ALR111 or ALR121 is used for subsystem
communication is as follows.
TIP
Information of the specified communication module is displayed even when the module is configured as a
redundant module.
I/O Module:
Node: 2
Slot: 4
Type: ALR111
IOM Model: ALR111-S03 S0U0H0-- F0--
Serial No: XXXXXXXX
Subsystem Name: (Subsystem name)

Revision: (Subsystem package release number)
IOM Status: (Communication module status) (Detail cause)

Port1 Status: (Port communication status)
Port2 Status: (Port communication status)
Communication Status
1 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
11 0000 A3B0 A3B0 A3B0 0000 0001 0001 0001 0001 0001
.
.
(4-kbyte dump display)
In the above example, communication definitions 1 to 11 indicate a normal status, while
communication definitions 12 to 14 indicate an A3B0 error. After the communication definition 16,
there is no communication definition or corresponding communication is not performed.

Table Display Items for ALR111/ALR121 in Subsystem Communication
Display item Description Remark
The name of the subsystem package currently loaded
Subsystem name to the ALR111/ALR121 is displayed.
(Example) Subsystem Name: S_MODBUS
The release number of the subsystem package in the
Subsystem package
ALR111/ALR121 is displayed.
release number
(Example) Revision: R1.01.30
The status of the communication module is displayed.
Control: Normal (at single configuration), control side in
the case of a redundant module Refer to the Diagnostic
Detail cause of
Stand-by: Stand-by side in the case of a redundant information message No.
communication module
module 0081 for the content of the
status
Fail: Error error cause code.
If the module status is Fail, the detail cause of the
error (error cause code) is displayed.
The statuses of port 1 and 2 are displayed. If the
communication module has generated an error, the
Port 1/2 communication previous statuses are displayed.
statuses Ready: The serial communication status is normal, or
there is no communication definition.
Error: A serial communication error has occurred.
The communication status is displayed for each
communication definition. This item is invalid if the
Communication status communication module has generated an error. The
(communication error status information for 128 definitions is displayed.
code for communication 0x0000: The communication status is normal.
definition n:1n128) 0x0001: There is no communication definition, or
communication is not performed.
0xA3XX: Communication error code
SEE
ALSO For the Diagnostic information messages, see the following:
No. 0081 of 3.1, Safety Control Station Error Occurrence and Recovery Messages of the Messages (IM
32S02B10-21E)
For the communication error codes displayed under Communication Status, see the manual for the
connected Modbus system and the following:
Communication Error Code in C3.1, Communication Specifications of the Open Interfaces (IM
32S05B10-21E)

<B5. Operations at SCS Startup> B5-1
B5. Operations at SCS Startup

An SCS always performs the initial cold start processing when it starts up. It does not
have a function that allows it to resume the operating mode it was in before stopping. The
operating mode at startup is always the Stop mode.
SEE
ALSO For more information about the operating mode, see the following:
B2, Operating Mode
n Types of SCS Startup Methods

An SCS can start up in one of the following three ways.
l Power Recovery Start

An SCS starts up in this way when the power supply is resumed after power failure.
l Start after Off-line Download

An SCS starts up in this way when the user performs off-line download from the SCS manager.
l Manual Restart
An SCS restarts when the restart switch of the CPU module is pressed or the user performs SCS
restart operation from SCS Manager of the SENG.
TIP
After starting SCS, the operation requests from the SENG and Workbench will be ignored until the
operating mode of the SCS changes to Waiting mode.
The same error will occur to the communications with FCS or HIS for the CENTUM integration as well
as Modbus slave communication. The operating mode of the SCS can be checked on the SCS State
Management Window or identified through the LED of the SCS CPU module.
A diagnostic information message notifying a failure/recovery may generate twice when the SCS is
restarted. This dose not present any problem in practical operations or on safety.

<B5. Operations at SCS Startup> B5-2
n Internal Data at SCS Startup

Since an SCS always performs initial cold start when it starts up, all operation areas and variable
values maintained dynamically by the SCS are initialized. System programs and databases that
were downloaded off-line and changes made online are saved in the flash memory and restored
at start up.
Moreover, when the SCS is started, data saved in the memory with battery backup may remain
without being initialized. This battery backup memory can hold data for approximately 300 hours
even if the power supply to the SCS is stopped. If the data is lost, it will be reset to the initialized
status.
The following are examples of data stored in the battery backup memory.
System log information
Diagnostic information (200)
SOE data log information (1000)
Table States of Internal Data at SCS Startup

Data storage Start after off-line Power recovery
Data within SCS
destination download start/manual restart
Variables in application logic Initial value Initial value
Function blocks perform Function blocks perform
Data within function blocks
initialization operation. initialization operation.
Main memory Security level Level 2 Level 2
Lock states of variables Unlocked Unlocked
Data of CENTUM
Initial value Initial value
integration function
Restore programs before power
System program Loaded programs
failure/station stop
Restore databases before
Database Loaded databases
power failure/station stop
Flash memory (*1)
Changes before power failure/
Changes made online
station stop are valid
Passwords for changing Passwords before loading Passwords before power failure/
security level are invalid (initialized) station stop are valid
Battery backup Retains log information Retains log information before
Various log information
memory before loading. power failure/station stop (*2)
*1: This assumes that writing to the flash memory has been completed.
*2: If a power failure lasts around 300 hours or more, the data in the memory is lost when the battery backup power runs out as well.

<B6. Actions Taken at Error Occurrence and Recovery Procedure> B6-1
B6. Actions Taken at Error Occurrence

and Recovery Procedure
This chapter explains the action taken when an error occurs in the system and the
recovery procedures. If an error occurs in the system, operations corresponding to the
error level are performed.
There are the following three error levels.
Fatal error
Major error
Minor error
SEE
ALSO For more information about system error detection by the self-diagnostic function, see the following:
B3, Diagnostic Management Function and Diagnostic Information Message
n Overview of System Operations at Occurrence of Fatal Errors and

Major Errors
The following provides an overview of system operations corresponding to the different SCS
error levels.
l Actions Taken at Fatal Error Occurrence

A fatal error disables hardware and/or software so that operation cannot be continued. Both sides
of a redundant CPU module stop and all output modules output the fail-safe value.
l Actions Taken at Major Error Occurrence

When a major error occurs, some hardware cannot continue the ordinary operation. When an
error occurs, the system takes action which you have configured in advance for the failure of
hardware. The application logics that handle major errors must also be configured.
l Shutdown Operations
The shutdown operations fix the output status from an SCS. There are the following three types
of operations:
Shutdown executed by a user-defined application logic
Shutdown where the CPU fixes the output values of areas with failures
Shutdown executed by an output module when it detects an error in the host system (CPU)
When a fatal error occurs, the CPU stops and all output modules shut down; this is called all
output shutdown.

<B6. Actions Taken at Error Occurrence and Recovery Procedure> B6-2
l Output Value at Fault
When an output module detects an error, the predefined fail-safe values will be used as the
output values. The fail-safe value of each output channel is referred to as the Output Value at
Fault. This value can be set on the I/O parameter builder for each DO or AO channel. For a DO
channel, this action depends on the setting of [Output Value in Detecting Error] and for an AO
channel, depends on the settings of [Output Processing at Fault] and [Output Value at Fault].
(Only the setting item of [Output Value at Fault] cannot validate this action.) However, the output
module does not output the Output Value at Fault in following status:
The output module being initialized
The output module with Output Shutoff switch and the switch is energized.
The malfunctioning output channel or the output module
Tip
The descriptions in the later chapters will have the explanations regarding the tight-shut values may become the
output values of the analog output modules if the [Tight-Shut/Full-Open] is enabled on the I/O Parameter builder.
However, if the [Tight-Shut/Full-Open] is disabled on the I/O Parameter builder, the output value of the module
becomes the default initial value upon power-on instead of the tight-shut value.
SEE
ALSO For more information about tight-shut/full-open and default initial value upon power-on, see the following:
Tight-shut/Full-open in Items Set for Each Channel (Analog Output) in A4.5, Items Set for Analog
Outputs
n Actions Taken at Minor Error Occurrence and Recovery Procedure

A minor error does not affect the application logic execution function itself, for example a one-
side failure of a redundant hardware device.
When an error occurs in a device that has been configured for dual redundancy, the control rights
get transferred to the device on standby so processing can continue. Such errors are regarded
as minor. After switching the control right, the same operation as for single configuration system
is performed. The fact that the control right is switched due to a failure is notified via a diagnostic
information message. Since the SCS can continue controlling in this case, the data status is not
changed nor is any error status notification to system function blocks performed. The user must
check that the control is switched and replace the faulty hardware.

<B6.1 Actions Taken at Fatal Error Occurrence and Recovery Procedure> B6-3
B6.1 Actions Taken at Fatal Error Occurrence

The CPU stops if a fatal error occurs in it. If the CPU module is in redundant configuration
and the control right is switched to the CPU module on the standby side, the error is
treated as a minor error. If the error affects the entire system, no output can be made, but
in other cases, communication from the CPU is stopped; all output modules output the
fail-safe value at CPU error. The fail-safe value is the value defined by the user in advance
with I/O Parameter Builder as the value output by output modules when the CPU fails.
B6.1.1 Actions Taken at Occurrence of Errors Affecting the

Entire System and Recovery Procedure
If the power supply to the entire system, including the CPU module and input/output
modules, fails, or the power supply to the system is started anew, the following
operations are performed.
n Actions Taken at Error Occurrence

Regardless of the duration of a power failure, the initial cold start processing is performed when
the power is supplied to the CPU nodes anew. Once the power starts to be supplied to the
system, input/output module startup processing is performed and the operating mode shifts to
the Waiting mode.
When this happens, 0 is output from the DO modules while the tight-shut value is output from
the AO modules, to the field.
n Recovery Procedure
The user should perform the output enable operation from the SENG after confirming that all
output modules have been started successfully. Once the output enable operation is performed,
output values of the application logic are output to the field. When all outputs are placed in the
Output Enable status, the operating mode shifts to the Running mode.
User operation Start supplying power Output enable operation
Output from CPU Stop Periodic output
Output modules processing start
Output from (*2) Result of application logic processing

(*1)
output modules
B060101E.ai
*1: 0 for DO modules, and 0.0 [mA] for AO modules.

*2: 0 for DO modules, and the tight-shut value for AO modules.
Figure Recovery from Errors Affecting the Entire System

B6.1.2 Actions Taken at CPU Module Error Occurrence and

Recovery Procedure
If an error occurs in the hardware of the CPU module, CPU node or software, only the CPU
stops. If the CPU module is placed in redundant configuration, a fatal error is judged when
both CPUs fail.
The CPU also stops when off-line download is performed to an operating SCS.

If the CPU does not create any data output for a certain length of time, the connected output
modules will assume that the CPU is in a status where it cannot set an output value, and all
output modules will output each fail-safe value specified by the user in advance. (This is called as
All output shutdown.) Input modules, on the other hand, are not affected by CPU errors. In the
case of redundant CPU modules, the same operation as for a single CPU module configuration
is performed if the module on the standby side fails.
In order to recover from an error occurred in the CPU module, the CPU module replacement may
or may not be necessary.
l Recovery Procedure by Replacing a Failed CPU Module
SEE
ALSO For the CPU module replacement procedure, see the following:
7.2.1, Maintenance for ProSafe-RS Equipment of the Engineering Guide (IM 32S01C10-21E)
The figure below illustrates the output values from the SCS after the CPU module has been
replaced, based on a single CPU module configuration.
Start of master
CPU
User operation database off-line
replacement Output enable operation
download
Completion of
download to input
/output modules
Output from Fail-safe value (*2) Result of application logic processing

output modules
B060102E.ai
*1: In the master database off-line download, configuration information is downloaded to the I/O modules.
Figure Recovery after CPU Module Replacement

l Recovery Procedure when the CPU Module is Restarted
Follow the recovery procedure below if the CPU module is restarted when the CPU and software
are normal.
1. Fail-safe values are being output to the field from output modules. When the CPU starts up,
the states of input/output modules are checked and the operating mode shifts to the Waiting
mode.
2. Perform the output enable operation from SCS Maintenance Support Tool in the SENG.
When output modules are placed in the Output Enable status, the result of the application
logic processing is output to the field. The operating mode shifts to the Running mode.
User operation CPU restart Output enable operation
Output from
Fail-safe value Result of application logic processing
output modules
B060103E.ai
Figure Recovery when the CPU Module is Restarted
n Off-line Download
If you perform off-line download to the running SCS, the CPU stops temporarily. Also, IOM
download is performed to all I/O modules. Once an off-line download is started, the output values
from output modules will conform to the Figure Recovery after CPU Module Replacement.

B6.1.3 Behavior at Abnormal Calculation

If there are mistakes in the application logic, intended control can no longer be performed.
For the sake of safety, such mistakes must be completely removed before starting the
actual operation, by thoroughly checking and testing in advance.
If there is any mistake that is left undeleted, causing overflow and other abnormal
calculations during execution of the application logic, SCS stops because correct control
cannot be continued. However, by making specifications with a builder, it is possible to
avoid stoppage of SCS and continue the operation (*1). Diagnostic information messages
are generated at occurrence of abnormal calculation and upon recovery respectively.
IMPORTANT
The purpose of this function is to temporarily avoid the error conditions of SCS. If an abnormal
calculation occurs, review the application logic as soon as possible and modify the logic such that
the abnormal calculation will not recur.
The SCS automatically recovers if the cause of abnormal calculation is removed or

resolved.
n Specification of Behavior at Abnormal Calculation

Use the SCS Constants Builder to specify the behavior at abnormal calculation.
SEE
ALSO For more information about how to specify the behavior at abnormal calculation with the SCS Constants Builder,
see the following:
If SCS Continues is specified as the behavior at abnormal calculation, the SCS will not fail even
if any of the abnormal calculation below occurs, and the SCS continues the operation.
Division by zero
Access to the outside of an array
Overflow in floating-point calculation
Overflow in casting
n Occurrence of Division by Zero

A division-by-zero calculation error occurs under the following conditions and is processed as
follows.
l Occurrence Conditions
The denominator is zero in a division of DINT or REAL type data.
l SCS Processing at Error Occurrence

If [SCS fails] is specified in SCS Constants Builder, SCS fails. But if [SCS continues] is specified
and this error occurs, the maximum value of the applicable type (the maximum negative value
if the value is negative) is assigned to the variable of the operation result. The POU (program)
where the calculation error occurred does not stop but operates until the end.

n Access to the Outside of an Array

An access to the outside of an array occurs under the following conditions and it is processed as
follows.
An index of an array variable points to the outside of the array.

and this illegal access occurs, the corresponding POU (function/function block) is stopped
immediately. The POU is executed in the next and subsequent scans as well, but the execution is
stopped at the same location unless the problem is resolved.
The POU (program/function/function block) that called the function/function block in which the
calculation error exists is executed until the end.
l SCS Processing at Error Occurrence when SCS Continues the Control

(Details)
If you specify a value exceeding an array size for an index of an array variable in a user-defined
function or user-defined function block described in the ST language, an error of accessing
outside the array range occurs. The processing of the user-defined function or user-defined
function block that caused the error is terminated immediately.
The return value of the user-defined function is zero (in the case of DINT, REAL or TIME
type) or FALSE (BOOL type).
In the case of user-defined function blocks, the output parameters that were written before
the occurrence of access to the outside of an array maintain the written values, and the
output parameters that were not written maintain the previous values. The same rule applies
to the local parameters as well.
The values above are passed to the POU that called the user-defined function or user-
defined function block where the illegal access occured and the POU is executed until the
end.

n Overflow in Floating-Point Calculation

An overflow in floating-point calculation occurs under the following conditions and is processed
as follows.
An overflow occurs in calculation between REAL type operands (*1).
*1: An overflow in integer calculation is not regarded as abnormal calculation.

and this error occurs, the maximum value of the given type is assigned to the variable of the
operation result. The maximum negative value is assigned if the first operand is negative in the
case of addition/subtraction as well as if the signs of first and second operands are different in the
case of multiplication/division. The POU (program) where the calculation error occurred does not
stop but operates until the end.
n Overflow in Casting
An overflow in casting occurs under the following conditions and is processed as follows.
When casting REAL type data to BOOL, DINT or TIME type, the resultant value exceeds the
maximum value that can be expressed by the variable.

and this error occurs, the following values are assigned to the variables of the calculation results.
Variable type Value
BOOL TRUE
DINT Maximum value of the DINT type (the maximum negative value if the value is negative)
TIME Maximum value of the DINT type
The POU (program) where the calculation error occurred does not stop but operates until the
end.
l SCS Processing at Error Occurrence when SCS Continues the Control (Details)
Casting from REAL type variable to DINT type
When casting a value of a REAL type variable to DINT type using the ANY_TO_DINT
operator, if the original value is greater than the maximum value that can be expressed by
DINT type, the calculation result is replaced by the maximum DINT value (the maximum
negative DINT value if the original value is negative).
Casting from REAL type variable to TIME type variable
When casting a value of a REAL type variable to TIME type using the ANY_TO_TIME
operator, if the original value is greater than the maximum value that can be expressed as
an unsigned 32-bit integer, the calculation result is replaced by the maximum value of an
unsigned 32-bit integer. Although the TIME type can express up to 24 hours, truncation
is not performed immediately when an overflow occurs; truncation is performed in the
subsequent arithmetic calculation. (The TIME type does not take a negative value, but if
a negative value is assigned in ANY_TO_TIME, the value is converted to a signed 32-bit
integer once and then treated as TIME type keeping the bit sequence.)

n Notification of Abnormal Calculation Occurrence/Recovery

Occurrence of abnormal calculations and recovery from them are notified via diagnostic
information messages if SCS continues the control. By using the system function block (SYS_
CERR), whether a calculation error has occurred or not can be handled in the application logic.
l Notification of Abnormal Calculation Occurrence

If a calculation error occurs, it is notified by the diagnostic information message (No. 4145) that
indicates an occurrence of abnormal calculation. If calculation errors occur in multiple POUs
(programs), a diagnostic information message is generated for each POU (program).
If different types of calculation errors occur in the same POU (program) at the same time, a
diagnostic information message is generated for each type of calculation error.
SEE
ALSO For more information about the diagnostic information messages, see the following:
No. 4145 Abnormal calculation occurred of the Messages (IM 32S02B10-21E)
l Re-notification of Abnormal Calculation Occurrence

If the abnormal calculation status continues for a certain period of time or longer, the diagnostic
information message notifying the abnormal calculation is generated repeatedly as warning.
The re-warning interval is 10 minutes by default. The re-warning interval can be changed using
SYS_CERR.
l Handling of Abnormal Calculation Status with Application Logic

The abnormal calculation status can be handled in the application logic by using the system
function block (SYS_CERR) (*1).
*1: SYS_CERR can be used in SCS databases created by SENG of R2.03.00 or later.
l Notification of Recovery from Abnormal Calculation

If the POU (program) that previously caused a calculation error is executed normally until the
end, the calculation error of the POU (program) is regarded to have been cancelled and the
diagnostic information message indicating recovery from abnormal calculation (No. 4146) is
notified. The diagnostic information message indicating recovery is generated for each diagnostic
information message notifying error occurrence.
SEE
ALSO For more information about the diagnostic information messages, see the following:
No. 4146 Recovery from abnormal calculation of the Messages (IM 32S02B10-21E)
n Behavior in Test Functions

In logic simulation tests and SCS simulation tests, behaviors at abnormal calculation are different
from those in the actual system.
SEE
ALSO For more information about abnormal calculation occurrence in test functions, see the following in the ProSafe-
RS System Test Reference (IM 32S04B30-21E):
n Debug and Test in 2, Logic Simulation Test Operations
n Other Differences in Operations between SCS Simulator and Actual SCS in 3.3.1, Operations Unique
to SCS Simulators

<B6.2 Actions Taken at Major Error Occurrence and Recovery Procedure> B6-10
B6.2 Actions Taken at Major Error Occurrence

This section explains the operations of an SCS when a major error occurs and the
recovery procedure, for the cases where errors occur in the following locations.
Input module
Input channel
Output module
Output channel
Communication path between the CPU module and input/output modules
Optical ESB bus repeater devices
n Notification of Error Status

An SCS notifies the application logic of the fact that an error occurred. It also notifies errors to
the user via the SCS State Management Window of the SENG, the Status Display view of the
HIS, and diagnostic information messages. Since the following processing is performed, the user
can create a shutdown application logic based on these conditions to determine desired output
values for each output module.
The status of channels belonging to the area with the failure becomes BAD.
The status is reflected in the system function block.
In the case of errors related to input modules and/or channels, the input value is set to the
Input value at error occurrence. The Input value at error occurrence is provided to the
application logic instead of the actual process value if an error is detected in input module .
The user must define in advance the Input value at error occurrence for each channel in
the I/O Parameter Builder.
SEE
ALSO For more information about items to be defined in I/O Parameter Builder, see the followings:
A4.4, Items Set for Analog Inputs
A4.5, Items Set for Analog Outputs
A4.6, Items Set for Discrete Inputs
A4.7, Items Set for Discrete Outputs
n Recovery from Error State

The following subsections explain the recovery measure to be taken for I/O modules when a
major error occurs. The following operations are needed to recover from an error.
IOM download
Output enable operation (for output modules only)
SEE
ALSO For the procedures of IOM download and output enable operation, see the following:
3.1.7, IOM Download of the Utilities and Maintenance Reference (IM 32S04B20-21E)

B6.2.1 Actions Taken at Input Module Error Occurrence

If there is a malfunction in an input module hardware, SCS treats it as an input module
error. In the case of a redundant input module, the control rights switches, but the
application logic continues running. This is considered as a minor error. The following
explains the operations performed when an error occurs in the case of modules in single
configuration or single operation status.

CPU processing
When an input module becomes abnormal, the CPU will force the pre-defined values on the
I/O parameter builder to all the channels of the module and force the data to BAD status.
The application logic should handle these changes in the inputs and statuses as errors. In
order to prevent the plant from the fatal damages caused by input module abnormalities, the
application logics for catching the abnormalities and handling the errors should be created.
Error notification
A module error is notified via a diagnostic information message (alarm class 1). The SCS
State Management Window of the SENG and the Status Display view of the HIS display
faulty modules in red, which indicates error.
Investigate the causes of the failure and replace the input module. When you perform IOM
download from the SENG, the CPU starts up the input module. Once the input value is acquired
normally, the data status returns to GOOD.
User operation Module replacement IOM download
Logical 1
BAD GOOD
data status 0
Logical
data value Input value at error occurrence Identical to the physical value
Physical 1
BAD GOOD
data status 0
Physical
(*1) Field value
data value
B060201E.ai
*1: The value varies with the input module type and status.
Figure Input Module Error

B6.2.2 Actions Taken at Input Channel Error Occurrence

An input channel error typically occurs in two cases, when there is an error on the field
side or when there is a hardware failure in individual channels of an input module.

CPU processing
The CPU sets the input value at error occurrence, which is a value defined by the user in
advance in I/O Parameter Builder, for the faulty input channel and sets the data status to
BAD.
Sensor Input Module Output Module Valve
Logic
Input value at
error occurrence
Fault Logic
Action
Action
Input modules fault is taken

account by application logic
as a demand.
B060202E.ai
Figure Overview of Operation when an Input Channel Error is Detected
Error notification
A channel error is notified via a diagnostic information message (alarm class 1). However,
the SCS State Management Window of the SENG and the Status Display view of the HIS
display the module where channel error has occurred in the color that indicates normal.

The type of recovery procedure to be used depends on whether or not the error occurred on the
module side.
l Recovery Procedure in the Case of Error on the Module Side

If a hardware error occurred in one or more channels of an input module, the input module needs
to be replaced. The module replacing procedure for single module configuration is as follows:
1. Fix the input values sent to the application logic from the related input variables. Use the
locking operation of the forcing function or maintenance override in order to fix the input
variables. This minimizes the impact at module replacement.
2. After replacing the module, perform IOM download.
The input module starts up normally.
Locking Module Unlocking IOM
User operation IOM download
input variables replacement input variables
1
Logical
data status 0 BAD Hold GOOD
Logical Input value at

error occurrence Hold Physical data value
data value
Faulty channel
Physical 1
BAD GOOD
data status 0
Physical
(*1) Field value
data value
Logical 1
GOOD Hold GOOD
data status 0
Logical
Physical data value Hold Physical data value
data value
Normal channel
Physical 1
GOOD BAD GOOD
data status
0
Physical
Field value (*1) Field value
data value
B060203E.ai
*1: The value varies with the input module type and status.
Figure Input Module Replacement (with Locking Operation)
SEE
ALSO For more information about locking input variables, see the following:
A8, Forcing
l Recovery Procedure in the Case the Module is Normal

If an error occurred on the field side or at the connection with an input module, simply eliminate
the causes of the error; the failure is removed, the channel resumes using the field value and the
data status becomes GOOD.

B6.2.3 Actions Taken at Output Module Error Occurrence

The result of the application logic processing is set to the logical data and physical
data of the relevant output variables, and this data is then written to each channel of the
corresponding output module via the I/O driver. On the other hand, the CPU acquires the
status of the output module as well as the status of each channel of the output module,
and sends diagnostic information messages or reflects the state information in the
system function block used for channel status display. By using a system function block,
module/channel statuses can be monitored via the application logic. The figure below
illustrates the relationship between the CPU and output module.
CPU Locked status Output disable status
Output module
I/O driver
CH1
Output CH2
Application shutoff switch
logic CH3
Data
update
Composed of data CH8

value and data status
B060204E.ai
Figure Overview of CPU and Output Module

If any output module has failed, the SCS performs failure diagnosis and switches the control
right and/or sends diagnostic information messages. If the control right of the duplexed modules
has been switched, the actions corresponding to a minor error is taken. If the output module was
operating in the single operation mode, the following actions are taken.
CPU processing
The CPU sets the fail-safe value, which is a value defined in advance in the I/O Parameter
Builder, for the physical data of each output channel of the faulty output module. The system
places all the output channels in the Output Disable status. At this point, the operating
mode shifts to the waiting mode. Writing to the output module is stopped thereafter. The
data statuses of all channels of the output module become BAD. The user can configure
the application logic so that other associated outputs are shut down automatically based on
data status changes of specific output channels to BAD.
Error notification
A module error is notified via a diagnostic information message (alarm class 1). In the SCS
State Management Window on the SENG or the Status Display view on the HIS, the failed
module is shown in red to indicate an error.

1. Investigate the cause of the failure and replace the output module.
If a system function block for output status display is used, the failure location can be
checked.
2. Perform IOM download from the SCS Maintenance Support Tool of the SENG. After the
IOM download, the CPU performs startup processing of the output module. If the startup
processing has been completed successfully, the output module is recognized as normal
and data update starts. After the module returns to normal, 0 is output for DO modules,
while the tight-shut value is output for AO modules, from all channels of the output modules.
3. Test the output module.
4. Perform the output enable operation from the SCS Maintenance Support Tool of the SENG.
Output values of the application logic will be output.
Once all output channels are placed in the Output Enable status, the operating mode shifts
to the Running mode.
The figure below illustrates the flow from a failure of an output module to the recovery.
Module IOM Output
User operation
replacement download enable operation The logical data value is
set to the result of the
application logic processing.
1
Logical data status BAD GOOD
0
Physical data value Fail-safe value (*2) Logical data value
1
Physical data status BAD GOOD
0
Output from IOM (*1) Physical data value

B060205E.ai

Figure Recovery from Output Module Error

B6.2.4 Actions Taken at Output Channel Error Occurrence

An output channel error typically occurs in two cases, when there is an error on the
field side or when there is a hardware failure in individual channels of an output module.
Depending on the cause of the failure, the Output Shutoff switch in the output module
may be activated and an output module failure may occur, in which case the action take
at error occurrence and recovery procedure may be different from those applicable to an
output channel error.
To prepare for output channel failures, an application logic must be created in advance for
each output channel using a function block for system status indication.
Actuator
Sensor Input Module Output Module
/Valve
Logic
Fault
Node System Action

Status
Function Action
Slot
Block
B060206E.ai
Figure Description of Logic Related to Output Failure
SEE
ALSO For more information about function blocks for system status indication, see the following:
C9, Safety System Function Blocks
The operation and recovery procedure for the case when an overload state has occurred
to an SDV526 module while it is outputting ON signals will be explained separately from
those for other output channel errors.


The actions taken at error occurrence are explained for each of the following two cases: when the
Output Shutoff switch is activated and when an error occurs in a single output channel without
activating the Output Shutoff switch.
l Channel Errors Accompanied by Activation of the Output Shutoff Switch

Even when the failure concerns only a certain output channel, the entire output module may be
affected if the Output Shutoff switch in the output module is activated. In this case, 0 and 0.0
[mA] are output from all output channels for the DO modules and AO modules, respectively.
The targets of output shutoff operation include dangerous failures (such as DO module channels
are clutched to ON status) and failures where internal module protection is required (such as
overcurrent of AO modules). However, the user can define in the I/O Parameter Builder whether
or not to activate the Output Shutoff switch for dangerous failures where module protection by the
system is not required.
The user must determine if the failure occurred in the field or in the module, based on the detailed
error information provided in the Diagnostic Information window and IOM Report dialog box.
SEE
ALSO For detailed error information provided in the IOM Report dialog box, see the following:
B4.1, IOM Report of AIO/DIO Modules
l Operation at Occurrence of Output Channel Errors

Errors that do not activate the Output Shutoff switch, such as disconnection on the field side, are
notified as failures of individual output channels. The following operations are performed if errors
occur in individual output channels.
CPU processing
The CPU sets the fail-safe value, which is a value defined by the user in advance in I/O
Parameter Builder, for the physical data of all the faulty output channels and places them
in the Output Disable status. At this point, the operating mode shifts to the Waiting mode.
Other normal output channels output the result of the application logic processing. The CPU
continues updating the data of the output module.
Error notification
An output channel error is notified via a diagnostic information message (alarm class 1).
The data status of the faulty output channel is set to BAD. In the SCS State Management
Window on the SENG and the Status Display view on the HIS, the output module is shown
in the color indicating a normal state. The status of each channel can be checked in the
Diagnostic Information window of SCS Maintenance Support Tool of the SENG.

If a channel error occurred, check the following in the SCS State Management Window and IOM
Report dialog box in the SCS Maintenance Support Tool to determine an appropriate recovery
measure.
Has the Output Shutoff switch been activated? Does the error concern only one channel?
Is it a hardware failure in the module or an error on the field side?
l Single Channel Errors (Disconnection and Other Errors on the Field Side)
1. Investigate the cause of failure and remove it so that the field can recover from the failure.
When the output module recovers, a recovery message is output and the fail-safe value,
which was defined by the user in advance, is output from the relevant output channel.
2. After confirming that the output module has recovered to normal, perform the output enable
operation from SCS Maintenance Support Tool of the SENG.
The result of the application logic processing is output.
User operation Complete recovery Output enable
of area with a failure operation The logical data value is
application logic processing.
Logical 1
data status BAD GOOD
0
Physical
Faulty channel Fail-safe value Logical data value
data value
Physical 1
data status BAD GOOD
0
Output from output module (*1) Physical data value

B060209E.ai

Figure Recovery from Channel Errors

l In the Case of Errors on a Single Channel (Module Channel Hardware Failure)
If any of the channels on the module side is judged to be erroneous, the output module must be
replaced.The figure below illustrates the recovery procedure and the data value and data status
at each timing.
User Output lock Module Output lock Output
IOM download
operation operation replacement cancellation enable operation
Logical 1
BAD GOOD
data status 0
Faulty Physical
Fail-safe value (*3) Logical data value
channel data value
Physical 1
BAD GOOD
data status 0
Logical 1
data status GOOD
0
Normal Physical (*3)

channel data value Logical data value Hold Fail-safe value Logical data value
Physical 1
data status GOOD BAD GOOD
0

Output from faulty channel Fail-safe value (*1) (*2) Physical data value
Output from normal channel Physical data value (*2) Physical data value
B060207E.ai
*1: Fail-safe value (This value may be set to 0 for DO modules and 0.0 [mA] for AO modules, depending on the failure condition.)
Figure Recovery from Channel Errors (with Module Replacement)

l When the Output Shutoff Switch Has Been Activated
If the Output Shutoff switch has been activated, check the SCS State Management Window. If
the module is shown in red, in most cases the problem is a module channel hardware failure. In
rare cases, however, an error on the field side may be the cause. Identify which is the case in the
IOM Report dialog box. In both cases, the recovery measures are the same as the procedures
taken after an error concerning a single channel. Follow the recovery procedure for error on
the field side or hardware failure depending on the situation. Note that the output values at fault
are different from those in the case of a single channel error. Specifically, 0 and 0.0 [mA] are
output from all channels for the DO modules and AO modules, respectively.
SEE
ALSO For the recovery procedure from channel hardware failures, see the following:
In the Case of Errors on a Single Channel (Module Channel Hardware Failure)
For the recovery procedure from errors on the field side, see the following:
Single Channel Errors (Disconnection and Other Errors on the Field Side)
Check the SCS State Management Window and if the module is shown in blue, the output
module is in the startup wait status. In this case, perform the following recovery procedure.
1. Investigate the cause of the failure and recover the field side.
2. When the recovery procedure has completed, perform the Start output module from the
SCS Maintenance Support Tool of the SENG.
The CPU performs startup processing of the output module. When the output module
recovers to normal status, the data status returns to normal.
3. Perform the output enable operation from the SCS Maintenance Support Tool of the SENG.
Output values of the application logic will be output.
SEE
ALSO For details on the Start output module, see the following:
Starting Output Modules of 3.1.6, Output Enable Operation of the Utilities and Maintenance
Reference (IM 32S04B20-21E)

n Operation and Recovery Procedure when Overload State is Detected

while SDV526 is Outputting ON Signal
This section explains the operations of the SDV526 module and the recovery procedure for the
cases where an output overload state(*1) has occurred while SDV526 is outputting ON signals.
When SDV526 is in a redundant configuration, signals are output from both modules. So, the
operation on detection of an overload state and the recovery procedure are explained separately
for the active module and standby module. The operation of SDV526 in a non-redundant
configuration is the same as the active module in a redundant configuration.
*1: An overload state occurs when the connected field device has a fault that causes a short circuit or overcurrent when the output
from the module is set to ON.
l Actions Taken for the Active Module in Redundant Configuration and the
Module in Non-Redundant Configuration
1. If an overload state is detected only in the active module of redundant configuration, the
control right is transferred to the standby module and the operation continues (*1). If an
overload state is detected on both modules, the standby module goes to IOM Fail and the
control right is not transferred.
*1: In this case, recover the error module that has become a standby module by carrying out the recovery procedure for a standby
module.
2. The module sets the output signal of the error channel to OFF, and the channel goes to an
Output Disable status.
3. The channel is released from the error but it remains in the Output Disable status.
Recovery Procedure
1. Clear the cause of overload state to recover the field device.
2. Use the SCS maintenance support tool on SENG and perform the output enable operation.
This allows the output value of the application logic to be output.
l Actions Taken for the Standby Module in Redundant Configuration

1. The output shutoff switch is activated and the standby module goes to IOM Fail.
2. In the SCS State Management Window of the SCS maintenance support tool, the modules
status is shown in blue (startup wait status).
Recovery Procedure
1. Clear the cause of overload state to recover the field device.
2. Use the SCS maintenance support tool on SENG and perform the output module startup
operation. The module starts up and operates as a standby module.

B6.2.5 Actions Taken at Errors between CPU and Input/

Output Module and Recovery Procedure
Errors between the CPU and input/output module refer to errors on both sides of the SB
bus and errors on both sides of the communication module of a node.
The value output from output channels when a system error is detected must be specified
in advance as a fail-safe value using I/O Parameter Builder.
SEE
ALSO For the actions taken at error occurrence when an optical ESB bus repeater is used, see the following:
B6.2.6 Actions Taken at Error Occurrence for Optical ESB Bus Repeater Devices

If a node error or bus error occurs, both the CPU and input/output module perform actions taken
at error occurrence, respectively.
l CPU processing
The input value at error occurrence is set for input variables corresponding to all the input
channels that do not respond.
The fail-safe value is set for the physical data of output variables corresponding to all the
output channels that do not respond, and they are placed in the Output Disable status.
The input value at error occurrence set for the input variables and the fail-safe value set for
the output variables are specified in I/O Parameter Builder.
The CPU stops updating data of the relevant output module.
SEE
ALSO For more information about items defined in I/O Parameter Builder, see the followings:
A4.4, Items Set for Analog Inputs
A4.5, Items Set for Analog Outputs
A4.6, Items Set for Discrete Inputs
A4.7, Items Set for Discrete Outputs
l Error notification
A channel error is notified via a diagnostic information message (alarm class 1). The data
status of all the channels is set to BAD.
When a node encounters an error, a diagnostic information message regarding the node
error will be generated.
When the node returns to normal, a diagnostic information message (alarm class 1) is
notified to indicate recovery from the I/O module error.

In order to make an output of an output module recover after handling a hardware failure, it is
necessary to perform the output enable operation from SCS Maintenance Support Tool of the
SENG.
User operation Complete recovery Output enable
of area with a failure operation The logical data value is
application logic processing
Logical 1
BAD GOOD
data status 0
All channels of an output
module connected to Physical
Fail-safe value Logical data value
an area with a failure data value
Physical 1
BAD GOOD
data status 0
Output from output modules Fail-safe value Physical data value

B060210E.ai
Figure Output Module Recovery from Communication Path Errors
TIP
Input modules resume using input values from the field and their data status becomes GOOD once the cause of
failure is removed.

B6.2.6 Actions Taken at Error Occurrence for Optical ESB

Bus Repeater Devices
This section explains the actions taken at error occurrence to the following optical ESB
bus repeater devices.
SNT401/SNT411, SNT501/SNT511 (Optical ESB bus repeater module)
SNT10D (Unit for optical bus repeater module)
SEE
ALSO For the recovery measure to be taken at errors of an optical ESB bus repeater, see the following:
Recovery Procedure in B6.2.5, Actions Taken at Errors between CPU and Input/Output Module and
Recovery Procedure
n Actions Taken at Errors of Optical ESB Bus Repeater/Fiber-optic Cable

The actions to be taken for a failure of optical ESB bus repeater module or abnormality of fiber-
optic cable is the same as the actions taken at an ESB bus error.
In the event of a failure in one of the optical ESB bus repeater modules in a redundant
configuration, or disconnection or other abnormality in any fiber-optic cable connecting
these modules, a diagnostic information message indicating a SSB401 error (Message No.
0065) is notified as the event of the I/O node connected via the applicable failure location.
Message (example) 0065 SCS0101 SBS Fair FIO NODE 02 SBS RIGHT
CPU Node (Node1)
S S
I I I I I I E E S S
O O O O O O C C C C
M M M M M M 4 4 P P P P
0 0 X X S S
1 1 X X U U
X X
SNT10D
S S S S S S
N N N N N N
T T T T T T
4 4 4 4 4 4 P P
0 0 0 0 0 0 S S
1 1 1 1 1 1 U U
Node2 Node4
S S S S S S S S
I I I I I I N N S S I I I I I I N N S S
O O O O O O T T B B O O O O O O T T B B
M M M M M M 5 5 4 4 P P M M M M M M 5 5 4 4 P P
0 0 0 0 S S 0 0 0 0 S S
1 1 1 1 U U 1 1 1 1 U U
Node3
S S
I I I I I I I I S S
O O O O O O O O B B
M M M M M M M M 4 4 P P
0 0 S S
1 1 U U
: Fiber-optic cable
B060211E.ai
Figure Connection Example

The actions taken at errors of optical ESB bus repeater modules is explained using the above
figure showing a connection example.
Nodes 2 and 3 are accessed via SNT401 and SNT501 modules. Therefore, a failure in any
SNT401 or SNT501 module relaying Node 2/3 will disable communication with Nodes 2 and 3.
A diagnostic information message indicating an SSB401 error (Message No. 0065) is
notified for Nodes 2 and 3 in either of the following cases:
- In the SNT10D shown in the figure, one of the SNT401 modules connecting Nodes 2 and
3 fails.
- One of the SNT501 modules installed in Node 2 fails.
If both of the SNT401 modules or SNT501 modules fail, a node error occurs in each I/O
node connected via the failed optical ESB bus repeater modules. If both of the SNT501
modules installed in Node 2 fail, Nodes 2 and 3 connected via the SNT501s generate an
error. Similarly if both of the SNT401 module installed in the SNT10D fail, Nodes 2 and 3
also generate an error.
TIP
A diagnostic information message indicating an ESB bus error (Message No. 0063) is issued only when an error
occurs in all I/O nodes excluding the CPU node. In a configuration where optical ESB bus repeater modules are
used to provide multiple ESB bus lines, this diagnostic information message (Message No. 0063) is not issued in
the event of an error in only one line. For example, assume a system configuration that partially uses optical ESB
bus repeater modules. Even if errors are occurred in bus 1 of all I/O nodes those are connected to the ESB bus
but are not connected to fiber-optics, the aforementioned diagnostic information message indicating an ESB bus
error (Message No. 0063) is not issued.
The same rule applies when the SEC402 is used to connect nodes to both the upper and lower sides. For
example, the diagnostic information message No. 0063 is not notified if errors occurred in only one side of the
duplicated buses of all I/O nodes connected via the upper connector.

n Actions Taken at Errors of Node Power Supply
Installing Optical ESB Bus Repeater Modules in a Unit for Optical Bus
Repeater Module
If optical ESB bus repeater modules are installed in a unit for optical bus repeater module
(SNT10D), set hardware setting switch [1] (installation unit setting DIP switch 1) on the optical
ESB bus repeater modules to 0: Installation in unit for optical bus repeater module. When the
switch is set this way, an error in one of the SNT10D power-supply modules will be notified as a
failure of the I/O nodes connected via the optical ESB bus repeater modules.
If an error occurs in one of the power-supply modules of the SNT10D in which the
optical ESB bus repeater modules are installed, the optical ESB bus repeater modules
of the corresponding side stop communicating. If the error occurred in the left power-
supply module, the optical ESB bus repeater modules installed in odd-number slots stop
communication. If the error occurred in the right power-supply module, the optical ESB
bus repeater modules installed in even-number slots stop communication. Because
communication stops from the optical ESB bus repeater module on one side, diagnostic
information messages indicating the SSB401 error (Message No. 0065) for all I/O nodes
connected via the applicable optical ESB bus repeater modules are notified.
In the event of an error in both of the power-supply modules of the SNT10D in which the
optical ESB bus repeater modules are installed, an error occurs in all I/O nodes connected
via the optical ESB bus repeater modules installed in the applicable SNT10D.
Installing Optical ESB Bus Repeater Modules in a CPU Node or I/O Node
If optical ESB bus repeater modules are installed in a CPU or I/O node, set hardware setting
switch [1] (installation unit setting DIP switch 1) to 1: Installation in node (safety control unit or
safety node unit).
If SW [1] is set to 1, the optical ESB bus repeater modules will continue to operate without
being affected, even if an error occurs in one of the power-supply modules of the node in
which the optical ESB bus repeater modules are installed.
In the event of an error in both of the power supply modules of the node in which the optical
ESB bus repeater modules are installed, an error occurs in this node and all I/O nodes
connected via the applicable optical ESB bus repeater modules.
IMPORTANT
When installing optical ESB bus repeater modules in a SNT10D, set the installation unit
setting DIP switch 1 to 0. If this switch is set to 1, an error in one of the power-supply
modules of the SNT10D will not be notified as a failure of the I/O nodes connected via the
optical ESB bus repeater modules.
When installing optical ESB bus repeater modules in a CPU or I/O node, set the installation
unit setting DIP switch 1 to 1. If this switch is set to 0, an error occurring in one of the
power-supply modules of the CPU or I/O will cause an error in the optical ESB bus repeater
modules on one side.

<B7.1 Redundant Configuration in SCS> B7-1
B7. Dual Redundancy

ProSafe-RS supports dual-redundant configurations of SCS CPU modules and input/
output modules. With the dual-redundant configuration, the continuous controllability
and operating efficiency can be improved. Moreover, with dual-redundantly configured
hardware, the continuity of plant safety monitoring will be guaranteed by switching the
control rights when an error occurs in the SCS hardware.
B7.1 Redundant Configuration in SCS

It is possible to employ redundant configuration for SCS CPU modules and input/output
modules. The control bus communication, power supply module, ESB bus/SSB401,
optical ESB bus repeater module and SB bus are placed in redundant configurations.
n CPU Module
The CPU module on the standby side performs the same control processing as the
control side even while it is in the standby status. For this reason, it is possible to take over
outputting data immediately after the control right is switched. Moreover, the operating mode
of the SCS does not change.
Only the CPU on the control side accesses the hardware composing the SCS and the CPU
on the standby side always sets the equivalent value as the processing result. Therefore,
the CPU modules on both sides always perform processing using the same data.
In redundant configuration, if the CPU module on the standby side is not in the STBY status
and the control right cannot be switched, the same operation as single configuration CPU
module is performed.
SOE data related to discrete inputs might be lost when the control right is switched between
the CPU modules.
CPU modules of the SCSP2 may not update data from analog input/discrete input modules
in the scan executed immediately after switching the CPU control right, but use data
read in the previous scan. Data read in 1 or 2 scans earlier may be used for sub-system
communication modules.

n Input/Output Modules
In an SCS, it is possible to mount input/output modules of the same type in two adjacent slots (*1)
to make them redundant. In the case of redundant configuration, one side becomes the control
side and the other becomes the standby side. Switching of the control right is performed by input/
output modules. The switching has no influence on the application logic.
*1: An odd-numbered slot and the even-numbered slot obtained by adding 1 to the odd slot number
It is not allowed to have redundant configuration across two nodes.

SOE data related to discrete inputs might be lost when the control right is switched between
the input modules even though the frequency is low.
A HART communication error may occur when the control right is switched between analog
input/output modules that support HART communication.
Table Operation of Redundant AIO/DIO Modules

AIO/DIO module Redundant operation
The input signal from the field is received in input modules on both the control
Analog input module
and standby sides. In the SCS, the input data of the input module on the control
Discrete input module
side is stored in the input variable
The SCS outputs the same value for output modules on both the control and
Analog output module standby sides. Only the output module on the control side outputs signals to
Discrete output module the field. If an error occurs on the module on the control side, the control right is
switched and outputting is continued
SEE
ALSO For more information about redundant communication modules, see the following:
2.16, Connection with Other Systems via Serial Communication of the Engineering Guide (IM 32S01C10-
21E)
n V net Communication
The SCS V net communication is redundant. The communication couplers are also redundant.
The CPU has a communication interface that supports the redundant V net. An SCS performs
communication while switching the bus to be used at regular intervals.
n Vnet/IP Communication
Vnet/IP is redundant. Independent subnets using bus 1 and bus 2 comprise redundant buses.
If both buses are normal, bus 1 is used for control communication, while bus 2 is used for open
communication. If a communication error occurs in bus 1, bus 2 is used to perform control
communication.
SEE
ALSO For details on Vnet/IP communication, see the following:
A1, Overview of Vnet/IP Network of the ProSafe-RS Vnet/IP (IM 32S56H10-21E)

n Power Supply Module

A redundant power supply module is installed on each of CPU nodes and I/O nodes of the SCS.
SCS monitors the status of the power supply at regular intervals and, if an error occurs, it notifies
the user about the error via the SCS State Management window of the SENG, the Status Display
view of the HIS, and diagnostic information messages. If one of the two power supplies mounted
on the CPU node has generated an error, it notifies two diagnostic information messages;
one corresponding to the error of the power supply module on the CPU node and the other
corresponding to the error of the power supply module on node 1.
n ESB Bus and SSB401

The ESB bus is redundant. Each SSB401 is connected to ESB bus, respectively. The
following operations also apply when optical ESB bus repeater devices are present along the
communication route.
Normally, redundant ESB buses are used in an alternating fashion.
If an error occurs in an SSB401 on one side, the error is notified to the user via a diagnostic
information message. If both modules fail, the error is treated as a node failure.
If an error occurs in one bus or SSB401, the SCS continues communication using only the
normal ESB bus on the other side.
An erroneous bus is monitored for normal recovery at regular intervals.
Errors in communication with all I/O nodes, except CPU node, are judged to be ESB bus
error.
n Optical ESB Bus Repeater Module

The optical ESB bus repeater modules are always used in a redundant configuration.
SEE
ALSO For details on the actions taken at errors of optical ESB bus repeater devices, see the following:
B6.2.6, Actions Taken at Error Occurrence for Optical ESB Bus Repeater Devices
n SB Bus
The SB bus is a backboard bus that connects the SSB401 and each input/output module. The
SB buses are redundant. Since each bus is connected to one SSB401 in a one-to-one fashion,
the SB bus is switched whenever an SSB401 is switched.
If an error occurs in one SB bus, the error is notified to the user via a diagnostic information
message. If both buses fail, the error is treated as a node failure.
In the case of one-side failure of an SB bus, only the ESB bus connected to the normal SB
bus is used.

<B7.2 CPU Redundant Status> B7-4
B7.2 CPU Redundant Status

The availability of an SCS can be improved by making CPUs redundant. Each of the
redundant CPUs can be in either control or standby states, which are unique to the CPU.
n CPU Status
In order to show the status of a redundant configuration, it is necessary to indicate the status of
each CPU separately. The operating status of the CPU is called the CPU status.
The CPU status indicates the operating status of the CPU.
The processing of the SCS references the CPU status as necessary. The user can check
the CPU status via the CPUs LED, the SCS State Management window of the SENG, and
the Status Display view of HIS.
If an error occurs in the standby CPU, the FAIL status is notified to the application logic via a
system block.
The figure below illustrates the CPU status shift. Note that in order to explain the CPU status,
the operating modes it can shift to from the Initial mode are called CTRL and STBY. These
indicate whether the CPU has the control right and are specific to the redundant status, i.e., not
related to the operating mode.
CPU Fail
CTRL
Remove the cause Program

of CPU Fail Start
Control
FAIL RDY
Change
Program
CPU Fail
Start
STBY
CPU Fail
B070201E.ai
Figure CPU Status
l FAIL (CPU Stopped)

The power is supplied to the CPU, but the software is not running in this status.
l RDY (CPU Initializing Status)

The system program is being set in the main memory in this status.
l CTRL (Control Status)

The system program runs inside the CPU and the CPU has the right to access input/output
modules in this status.
l STBY (Standby Status)

The system program runs inside the CPU but the CPU does not have the right to access input/
output modules in this status.
n CPU Status Shift in Redundant Configuration

The figure below illustrates each CPU status and how it may shift in redundant configuration. The
thick arrows from (a) to (d) indicate the flow from the startup to normal operation in redundant
configuration. Note that the figure below does not represent the status by the mounting positions
of the CPUs. Even if the states of the two CPUs are switched, the indication in the figure shows
them in the same status.
(a)
(e)
FAIL CTRL control side
CTRL
FAIL CPU status
FAIL
stand-by side
STBY
CPU status
(b) (c) APC (d)
RDY CTRL CTRL
FAIL RDY STBY
Single Operation
B070202E.ai
Figure States at Redundant Configuration
Table CPU Status

Status Description
(a) CPUs on the both sides stopped.
(b) The controlling CPU starts up and sets programs and databases in the main memory.
The controlling CPU obtains the control right and starts up the standby CPU. Upon launching, the
standby CPU copies the image of the main memory of the controlling CPU into its main memory (this
(c)(*1)
status is displayed as APC and not the same as status (e)). The controlling CPU executes the user
application.
Both the controlling and standby CPUs operate normally in redundant configuration. This status is
(d)
called the redundant control status.
In this status, the standby CPU is stopped in redundant configuration, or the controlling CPU is
(e)(*1)
stopped and the control right is switched. The same operation as in single configuration is performed.
*1: Single operating status.

The CPU shifts to each status in the following manner.
Table Conditions of CPU Status Shift
Before After Shifting conditions
The power supply to the SCS is started.
(a) (b) SCS off-line download is completed.
The system is restarted.
(b) (c) The controlling CPU started normally.
(c) (d) APC of the standby CPU is completed.
The control right is switched due to a failure of the controlling CPU hardware or the
(d) (e)
standby CPU failed.
(e) (c) The standby CPU is replaced or a CPU recovered from transient failure.
(b) (a) An error occurred in the self-diagnosis at startup.
(c) (a) A fatal error occurred while operating in a single CPU operation.
(d) (a) Power failure occurred in the SCS (including momentary power failure).
(e) (a) A fatal error occurred while operating in single CPU operation.
l APC Status
The APC status refers to the status where the data in the CPU memory is being copied from the
control side to the standby side. The APC status can be checked by the LED on the CPU, the
SCS Status Display window of the SENG or the Status Display view on the HIS. The start and
end of the APC status are notified via a diagnostic information message.

<B7.3 Automatic Execution of IOM Download> B7-7
B7.3 Automatic Execution of IOM Download

After replacing input/output modules, it is necessary to perform IOM download in order
to set configuration information. However, you can specify automatic execution of IOM
download in following conditions:
In the case of automatic execution of IOM download, if a redundant module on the
standby side is replaced for maintenance, the configuration information is automatically
downloaded from the module on the control side to the replaced module. This operation
is possible only when specified in the SCS Constants Builder. If it is not specified, manual
IOM download is required after replacing the module on the standby side. When both
sides of redundant AIO/DIO modules or modules of single configuration are replaced,
manual IOM download must be performed as well. Automatic IOM download is not
performed on communication modules (*1).
*1: Automatic execution of IOM download is supported by the SCS of SCS system program R2.03 or later.
SEE
ALSO For more information about specification methods in the SCS Constants Builder, see the following:
n IOM Download Automatic Execution Conditions

If a redundant module on the standby side is replaced, IOM download is automatically executed if
the following conditions are met.
Automatic IOM download is enabled in the SCS Constants Builder.
The redundant AIO/DIO module on the control side is operating normally.
The replaced redundant module on the standby side failed due to configuration error (*1).
*1: Except the case where the model names on the control and standby sides are different or the case of hardware failure (the
STATUS LED of the module is OFF).

<B7.3 Automatic Execution of IOM Download> B7-8
n Operations during Automatic IOM Download

The SCS operates as follows while automatic IOM download is being executed.
If multiple AIO/DIO modules on the standby side are replaced, the processing of automatic
IOM download is executed sequentially on a one-by-one basis.
Diagnostic information messages (No. 0475 and 0476) are notified at the start and
completion of automatic IOM download.
If an error occurs during automatic execution of IOM download, the diagnostic information
message indicating erroneous termination of automatic IOM download (No. 477) is notified
and the IOM download processing is aborted.
IMPORTANT
Do not remove and put back the applicable AIO/DIO module while automatic IOM download
is being executed. If it is removed and put back, a major failure may occur in the module (the
STATUS LED of the module becomes OFF).
Automatic download is completed in approximately 30 seconds after inserting the module on the
standby side, and the diagnostic information message indicating completion of IOM download
(No. 0476) is output. If you need to remove and put back a module, check the diagnostic
information message indicating completion of IOM download in the Diagnostic Information
window of the SCS Maintenance Support Tool before doing so.
If a major failure occurs due to erroneous removal and reinsertion, perform IOM download
manually to the applicable AIO/DIO module, and then remove and reinsert the module after the
completion.
Automatic IOM download is not executed on AIO/DIO modules to which online change
download of input/output parameters or manual IOM download are being executed.
However, automatic IOM download to a different module is executed in parallel.
If it is attempted to execute online change download of input/output parameters or manual
IOM download on the applicable AIO/DIO modules for which automatic IOM download is
being executed, an error occurs in the manual download.

<C1.1 Types of Functions and Function Blocks> C1-1
C1. Overview of POU

A POU (Program Organization Unit) is a generic name for programs, function blocks and
functions.
In ProSafe-RS, programs, function blocks and functions are defined using Link
Architecture View and Multi-Language Editor of the Workbench.
In Part C of this manual, function block, function and application logic may be
abbreviated as an FB, FU and logic, respectively.
SEE
ALSO For more information about POUs, see the following of the Workbench in the Workbench Users Guide:
POUs (Program Organization Units) of Link Architecture View
For more information about the ProSafe-RS applicable POU types and notices on using the POUs, see the
following:
2.4, Overview of POU of the Engineering Guide (IM 32S01C10-21E)
C1.1 Types of Functions and Function Blocks

In ProSafe-RS, users implement an application using the Function Block Diagram (FBD),
Ladder Diagram (LD) or Structured Text (ST) programming languages.
With FBD, an application is written using functions (FU) and function blocks (FB). Some
elements from the Ladder Diagram programming language (Ladder elements) can also be
used.
In LD, an application is written using Ladder elements. Some FUs and FBs can also be
used.
Structured Text can be used to create FU/FB using the conditional statements and other
statements. However, it cannot be used for creating a complete program.
Some of the FUs and FBs provided by the ProSafe-RS system can be used in safety loops
(safety FUs/FBs) while others cannot be used in safety loops (Interference-free FUs/FBs).
FUs and FBs that cannot be used in safety loops are designed not to interfere with the
safety functions (interference-free).
SEE
ALSO For more details about Structured Text, see the following:
2.5, Structured Text of the Engineering Guide (IM 32C01C10-21E)

n List of Safety FUs and FBs

The tables below list safety FUs and FBs.
Table List of Safety Functions (FUs)
Function Support Reference
Description
name From (*1) (*2)
+ (ADD) +, meaning addition
(SUB) , meaning subtraction
(MUL) , meaning multiplication
/ (DIV) /, meaning division
1GAIN Assignment
ABS Gives the absolute (positive) value of a real value
AND AND
EQ =, meaning equal
GE >=, meaning greater than or equal to
GT >, meaning greater than
IB_TO_S Converts IO_BOOL-type input to data status R1.01.30 C2.9
IB_TO_V Converts IO_BOOL-type input to data value R1.01.30 C2.8
IR_TO_S Converts IO_REAL-type input to data status R1.01.30 C2.11
IR_TO_V Converts IO_REAL-type input to data value R1.01.30 C2.10
LE <=, meaning less than or equal to
LIMIT Limits the range of the input values to output (INTEGER)
LT <, meaning less than
MAX Selects the larger of two input values (INTEGER)
MIN Selects the smaller of two input values (INTEGER)
MUX4 Selects one of four input values (INTEGER)
MUX8 Selects one of eight input values (INTEGER)
MUXBOOL4 Selects one of four input values (BOOL) C2.1
MUXBOOL8 Selects one of eight input values (BOOL) C2.2
MUXREAL4 Selects one of four input values (REAL) C2.3
MUXREAL8 Selects one of eight input values (REAL) C2.4
NE , meaning unequal
NOT Negation
OR OR
ROL Make the bits of an integer rotate to the left. Rotation is made on 32 bits.
ROR Make the bits of an integer rotate to the right. Rotation is made on 32 bits.
Converts a 0-100% range of input values into a normalized range for
SCALER C2.5
outputting
SEL Selects one of two input values (INTEGER)
SEL_R Selects one of two input values (REAL) R1.01.30 C2.6
SEL_T Selects one of two input values (TIME) R1.01.30 C2.7
Make the bits of an integer shift to the left. Shift is made on 32 bits. Zero is
SHL
used to replace lowest bit.
Make the bits of an integer shift to the right. Shift is made on 32 bits.
SHR
Highest bit is copied at each shift.
SQRT Calculates the square root of a real value
XOR Exclusive disjunction (exclusive OR)
*1: Indicates that the function can be used in new SCS databases created by SENG of software release number shown in the table
or later.
If no indication, it means the function is supported from the release R1.01.00.
*2: Indicates the related explanations in this document. If no indication, it means the related explanations can be found in Workbench
Users Guide.

Table List of Safety Function Blocks (FBs) (1/2)
Function Support Reference
Description
block name From (*1) (*2)
ANLG_S Outputs high/low alarm with scale conversion (with data status input) R1.02.00 C3.7
ANLG1OO2D 1oo2D analog voter C3.4
ANLGI Outputs high/low alarm with scale conversion C3.8
ANLGVOTER 3-input analog voter (IO_REAL) C3.5
ANN_FUP First-up alarm annunciator R2.03.00 C3.15
B_TO_IB Converts data values and status to IO_BOOL-type outputs R1.01.30 C3.13
BOOLVOTER 3-input BOOL voter (IO_BOOL) C3.6
Receives data on consumer side for inter-SCS safety communication
CONS_B C4.4
(BOOL)
CONS_I C4.5
(INTEGER)
CONS_R C4.6
(REAL)
CTD Count down counter C3.11
CTU Count up counter C3.10
CTUD Count up/down counter C3.12
F_TRIG Detects a falling edge
FILTER First-order lag filter C3.2
FILTER_S First-order lag filter with data status analysis capability C3.3
FUP_RST Resets the First-up alarm annunciator R2.03.00 C3.16
GOV_B Grouping Overrides from HIS (BOOL) R1.03.00 C5.2
GOV_IB Grouping Overrides from HIS (IO_ BOOL) R1.03.00 C5.2
LTSND Sends Link Transmission data R1.03.00 C4.7
LTRCV Receives Safety Link Transmission data R1.03.00 C4.8
MOA Analog-type data manual operation R1.02.00 C5.6
MOB_11 Data manual operation with two-position answerback (BOOL) R1.02.00 C5.3
MOB_21 Data manual operation with three-position answerback (BOOL) R1.02.00 C5.4
MOB_RS Auto-reset data manual operation (BOOL) R1.02.00 C5.5
OVR_B Overrides from HIS (BOOL) C5.1
OVR_I Overrides from HIS (INTEGER) C5.1
OVR_IB Overrides from HIS (IO_BOOL) C5.1
OVR_IR Overrides from HIS (IO_REAL) C5.1
OVR_R Overrides from HIS (REAL) C5.1
PASSWD Manipulates BOOL-type data using password from HIS C5.2
or later.
Users Guide.

Table List of Safety Function Blocks (FBs) (2/2)
Function block Support Reference
Description
name From (*1) (*2)
Transmits data on producer side for inter-SCS safety communication
PROD_B C4.1
(BOOL)
PROD_I C4.2
(INTEGER)
PROD_R C4.3
(REAL)
R_TO_IR Converts data values and status to IO_REAL-type outputs R1.01.30 C3.14
R_TRIG Detects a rising edge
REPEATTIMER Alternates TRUE and FALSE outputs at specified intervals C3.1
RS Reset dominant bistable
SR Set dominant bistable
SYS_ALLSD Shuts down Station output R1.02.00 C9.11
SYS_CERR Indicates the existence of abnormal calculations R2.03.00 C9.20
SYS_CHST Detects fault in channels C9.18
SYS_DIAG Outputs diagnosis information C9.6
SYS_FORCE Manages forcing C9.2
SYS_FORCE_BD Manages forcing of Inter-SCS safety communication data R2.03.00 C9.4
SYS_FORCE_LT Manages forcing of SCS Link Transmission R1.03.00 C9.3
SYS_INST Detects fault in input module channels C9.17
SYS_IOALLST Detects fault in all I/O channels C9.13
SYS_IOSD Shuts down Module output R1.02.00 C9.12
SYS_LTSTS Indicates SCS Link Transmission reception status R1.03.00 C9.5
SYS_NODEST Detects fault in all I/O channels in node C9.14
SYS_OUTEN Indicates Output module output status R1.02.00 C9.19
SYS_OUTST Detects fault in output module channels (for 8 channels) C9.15
SYS_OUTST16 Detects fault in output module channels (for 16 channels) R1.02.00 C9.16
SYS_OVR Manages override function blocks C9.9
SYS_PSWD Manages password function blocks C9.10
SYS_SCANEXT Indicates the extension of scan period R2.03.00 C9.21
SYS_SEC_CTL Protects Security level R1.01.30 C9.8
SYS_SECURE Manages Security level C9.7
SYS_STAT Manages the SCS status C9.1
TOF Off-delay timer
TON On-delay timer
Pulse timer which outputs pulses for a specified duration after rising edge
TP
detection
VEL Detects the velocity limit exceeded C3.9
or later.
Users Guide.

n List of Safety Ladder Elements

The table below lists safety Ladder elements.
Table List of Safety Ladder Elements
Ladder element name Description Use in FBD
Direct Contact Direct contact Possible
Inverted Contact Inverted contact Possible
Contact with Rising Edge Detection Contact with rising edge detection Possible
Contact with Falling Edge Detection Contact with falling edge detection Possible
Direct Coil Direct coil Possible
Inverted Coil Inverted coil Possible
SET Coil SET coil Possible
RESET Coil RESET coil Possible
Coil with Rising Edge Detection Coil with rising edge detection
Coil with Falling Edge Detection Coil with falling edge detection
Possible: Means the element can be used in FBD.
n List of Interference-free FUs and FBs

The tables below lists FUs and FBs that are interference-free (do not interfere with the safety
functions).
Table List of Interference-free Functions (FUs)
Support From Reference
Function name Description
(*1) (*2)
ACOS Calculates the Arc cosine of a real value
ANY_TO_BOOL Converts to BOOL-type
ANY_TO_DINT Converts to INTEGER-type
ANY_TO_REAL Converts to REAL-type
ANY_TO_TIME Converts to TIME-type R1.03.00 (*3)
ASIN Calculates the Arc sine of a real value
ATAN Calculates the Arc tangent of a real value
COS Calculates the Cosine of a real value
Calculates the Common logarithm(base 10) of a real
LOG R1.03.00
value
MOD Calculates the Modulo of an integer value R1.03.00
POW Performs power calculation
SIN Calculates the Sine of a real value
TAN Calculates the Tangent of a real value
or later.
Users Guide.
*3: ANY_TO_TIME can be used with SENG of version R1.03 or later.

Table List of Interference-free Function Blocks (FBs)
Function block Support Reference
Description
name From (*1) (*2)
ANN Transmits annunciator message C6.1
AVERAGE Calculates the average of a specified duration
ECW_B Sets data of a BOOL-type variable from an external device C8
ECW_I Sets data of a INTEGER-type variable from an external device C8
ECW_R Sets data of a REAL-type variable from an external device C8
LIM_ALRM Hysteresis on a real value for high and low limits
LTFCS Receives Interference-free link transmission data R1.03.00 C6.5
SCI_B Input from subsystem (BOOL) R1.01.30 C7.1
SCI_I Input from subsystem (INTEGER) R1.01.30 C7.2
SCI_R Input from subsystem (REAL) R1.01.30 C7.3
SCO_B Output to subsystem (BOOL) R1.01.30 C7.4
SCO_I Output to subsystem (INTEGER) R1.01.30 C7.5
SCO_R Output to subsystem (REAL) R1.01.30 C7.6
SOE_B BOOL-type data SOER C6.2
SOE_I INTEGER-type data SOER C6.3
SOE_R REAL-type data SOER C6.4
SYS_ALARM Outputs alarm transmission status C10.3
SYS_ALRDSP Outputs status of subsystem communication modules R1.01.30 C10.8
SYS_ESBINF Outputs ESB bus status R1.02.00 C10.5
SYS_FORCE_SC Manages forcing of subsystem communication data R1.01.30 C10.9
SYS_IOMDSP Outputs the IOM status C10.7
SYS_NETST Outputs Control bus status R1.02.00 C10.4
SYS_NODEINF Outputs node status R1.02.00 C10.6
Outputs application logic execution time and percentage of CPU idle
SYS_SCAN C10.1
time
SYS_STAT_SC Indicates output enable operation in subsystem communication R1.01.30 C10.10
SYS_TIME Outputs SCS clock information C10.2
or later.
Users Guide.

<C1.2 Common Specifications> C1-7
C1.2 Common Specifications

This section explains specifications used commonly in each FU and FB.
n Execution Order of POUs

SEE
ALSO For the execution order of POUs, see the following of the Workbench in the Workbench Users Guide:
n Basic Types, Structures

SEE
ALSO For more information about the basic data types and structure types that applicable in FU and FB of ProSafe-RS,
see the following:
Data Type of Variables of 2.4, Overview of POU of the Engineering Guide (IM 32S01C10-21E)

n Common Constants
In ProSafe-RS, the following constants have been defined in advance. These constants can be
used when creating an application for the purpose of making the application easier to read.
Users can add constants as required. Do not change the following constants, however.
Table Pre-defined Constants
Name Value Description
TRIP_NONE 0 Do not regard signals as tripping signals
TRIP_OFF 1 Regard the falling edge of a signal (TRUE to FALSE) as a tripping signal
TRIP_ON 2 Regard the rising edge of a signal (FALSE to TRUE) as a tripping signal
n Reserved Keywords in the System

There are certain keywords reserved for the ProSafe-RS system, such as the designation of FU
or FB, and words listed in the following table. These reserved keywords in the system cannot be
used for function block names, variable names, and others.
Table List of Reserved Keywords (1/2)
Initial Reserved keywords
A ABS, ACOS, ADD, ANA, AND, _AND, AND_MASK, ANDN, ARRAY, ASIN, AT, ATAN
BCD_TO_BOOL, BCD_TO_INT, BCD_TO_REAL, BCD_TO_STRING, BCD_TO_TIME, BOO,
B BOOL, BOOL_TO_BCD, BOOL_TO_INT, BOOL_TO_REAL, BOOL_TO_STRING, BOOL_TO_
TIME, BY, BYTE
C CAL, CALC, CALCN, _CALL, _CALL_IEC_SFC_FB, CALN, CALNC, CASE, CONCAT, CONSTANT,
D DATE, DATE_AND_TIME, DELETE, DINT, DIV, DO, DT, DWORD
ELSE, ELSIF, EN, _END, END_CASE, END_FOR, END_FUNCTION, END_IF, END_PROGRAM,
E END_REPEAT, END_RESSOURCE, END_STRUCT, END_TYPE, END_VAR, END_WHILE, ENO,
EQ, EXIT, EXP, EXPT
F FALSE, FEDGE, FIND, FOR, FUNCTION
G GE, GFREEZE, GKILL, _GOTO, GRST, GSTART, GSTATUS, GT
I IF, _IF, INSERT, INT, INT_TO_BCD, INT_TO_BOOL, INT_TO_REAL, INT_TO_STRING, INT_TO_
J JMP, JMPC, JMPCN, JMPN, JMPNC
L LD, LDN, LE, LEFT, LEN, LIMIT, LINT, LN, LOG, LREAL, LT, LWORD
M MAX, MID, MIN, MOD, MOVE, MSG, MUL, MUX
N NE, NOT, _NOT
O OF, ON, OPERATE, OR, _OR, OR_MASK, ORN
P PROGRAM, _POP_CSTK, _PUSH_CSTK, _PUSH_PAR
R, REDGE, READ_ONLY, READ_WRITE, REAL, REAL_TO_BCD, REAL_TO_BOOL, REAL_TO_
R INT, REAL_TO_STRING, REAL_TO_TIME, REDGE, REPEAT, REPLACE, RESSOURCE, RET,
_RET, RETAIN, RETC, RETCN, RETN, RETNC, RETURN, RIGHT, ROL, ROR
S, SEL, SHL, SHR, SIN, SINT, SQRT, ST, _STEP, STN, STRING, STRING_TO_BCD, STRING_
TO_BOOL, STRING_TO_INT, STRING_TO_REAL, STRING_TO_TIME, STRUCT, SUB,
SYS_ERR_READ, SYS_ERR_TEST, SYS_INITALL, SYS_INITANA, SYS_INITBOO, SYS_
S
INITTMR, SYS_RESTALL, SYS_RESTANA, SYS_RESTBOO, SYS_RESTTMR, SYS_SAVALL,
SYS_SAVANA, SYS_SAVBOO, SYS_SAVTMR, SYS_TALLOWED, SYS_TCURRENT, SYS_
TMAXIMUM, SYS_TOVERFLOW, SYS_TRESET, SYS_TWRITE, SYSTEM

Table List of Reserved Keywords (2/2)
Initial Reserved keywords
TAN, TASK, THEN, TIME, TIME_OF_DAY, TIME_TO_BCD, TIME_TO_BOOL, TIME_TO_INT,
T
TIME_TO_REAL, TIME_TO_STRING, TMR, TO, TOD, TRUE, TYPE
U UDINT, UINT, ULINT, UNTIL, USINT
VAR, VAR_ACCESS, VAR_EXTERNAL, VAR_GLOBAL, VAR_IN_OUT, VAR_INPUT, ,VAR_
V
OUTPUT
W WHILE, WITH, WORD
X XOR, _XOR, XOR_MASK, XORN

<C1.3 User-defined Functions and Function Blocks> C1-10
C1.3 User-defined Functions and Function

Blocks
ProSafe-RS allows users to define unique FUs and FBs. These FUs and FBs are called
user-defined FUs and user-defined FBs, respectively.
n User-defined FUs and FBs

ProSafe-RS provides standard FUs and FBs such as AND and TON, and users can define
other FUs and FBs in order to write logics used commonly in applications as well.
FUs and FBs defined by users are called user-defined FUs and user-defined FBs,
respectively. User-defined FUs and FBs can be used in any programs, FUs and FBs just like
standard FUs and FBs.
SEE
ALSO For how to create user-defined FUs and FBs, see the following of the Workbench in the Workbench Users
Guide:

<C2.1 MUXBOOL4 (BOOL-Type Multiplexer with 4 Entries)> C2-1
C2. Safety Functions

This chapter explains the safety functions implemented in ProSafe-RS.
The safety functions are shown below.
BOOL-Type Multiplexer with 4 Entries (MUXBOOL4)
BOOL-Type Multiplexer with 8 Entries (MUXBOOL8)
Real-Type Multiplexer with 4 Entries (MUXREAL4)
Real-Type Multiplexer with 8 Entries (MUXREAL8)
Scaler (SCALER)
Real-Type Binary Selector (SEL_R)
TIME-Type Binary Selector (SEL_T)
Converter (IO_BOOL to Data Value) (IB_TO_V)
Converter (IO_BOOL to Data Status) (IB_TO_S)
Converter (IO_REAL to Data Value) (IR_TO_V)
Converter (IO_REAL to Data Status) (IR_TO_S)
SEE
ALSO For the information about safety functions not explained in this chapter, see the following of the Workbench in
the Workbench Users Guide:
Standard Functions of Language Reference
C2.1 MUXBOOL4 (BOOL-Type Multiplexer with 4

Entries)
A MUXBOOL4 function is a 4-input multiplexer for BOOL-type data. It selects one value
out of four input values.
MUXBOOL4
SELC
IN1
IN2
IN3
IN4 Q
C020101E.ai
Figure MUXBOOL4

n Arguments
Table Arguments of MUXBOOL4
IN/OUT Arguments Data type Description
SELC DINT Selector value (0 to 3)
IN1 BOOL Input value 1
IN IN2 BOOL Input value 2
Output value
= Input value 1 (SELC = 0)
OUT Q BOOL
= FALSE (SELC is a value other than the above)
n Description
The MUXBOOL4 function is a 4-input multiplexer for BOOL-type data. It selects one value out of
four input values.
If a value other than 0 to 3 is specified for SELC, the output value becomes FALSE.

C2.2 MUXBOOL8 (BOOL-Type Multiplexer with 8

Entries)
A MUXBOOL8 function is an 8-input multiplexer for BOOL-type data. It selects one value
out of eight input values.
MUXBOOL8
SELC
IN1
IN2
IN3
IN4
IN5
Q
IN6
IN7
IN8
C020201E.ai
Figure MUXBOOL8
n Arguments
Table Arguments of MUXBOOL8
IN IN2 BOOL Input value 2
:
Output value
OUT Q BOOL
:
= FALSE (SELC is a value other than the above)
n Description
The MUXBOOL8 function is an 8-input multiplexer for BOOL-type data. It selects one value out of
eight input values.
If a value other than 0 to 7 is specified for SELC, the output value becomes FALSE.

<C2.3 MUXREAL4 (Real-Type Multiplexer with 4 Entries)> C2-4
C2.3 MUXREAL4 (Real-Type Multiplexer with 4

Entries)
A MUXREAL4 function is a 4-input multiplexer for real number-type data. It selects one
value out of four input values.
MUXREAL4
SELC
IN1
IN2
IN3
IN4 Q
C020301E.ai
Figure MUXREAL4
n Arguments
Table Arguments of MUXREAL4
IN1 REAL Input value 1
IN IN2 REAL Input value 2
Output value
OUT Q REAL
= 0.0 (SELC is a value other than the above)
n Description
The MUXREAL4 function is a 4-input multiplexer for real number-type data. It selects one value
out of four input values.
If a value other than 0 to 3 is specified for SELC, the output value becomes 0.0.

<C2.4 MUXREAL8 (Real-Type Multiplexer with 8 Entries)> C2-5
C2.4 MUXREAL8 (Real-Type Multiplexer with 8

Entries)
A MUXREAL8 function is an 8-input multiplexer for real number-type data. It selects one
value out of eight input values.
MUXREAL8
SELC
IN1
IN2
IN3
IN4
IN5
IN6 Q
IN7
IN8
C020401E.ai
Figure MUXREAL8
n Arguments
Table Arguments of MUXREAL8
:
Output value
OUT Q REAL
:
= 0.0 (SELC is a value other than the above)
n Description
The MUXREAL8 function is an 8-input multiplexer for real number-type data. It selects one value
out of eight input values.
If a value other than 0 to 7 is specified for SELC, the output value becomes 0.0.

<C2.5 SCALER (Scaler)> C2-6
C2.5 SCALER (Scaler)

A SCALER function converts input data (0 to 100%) to the specified scale.
SCALER
IN OUT
SH
SL
C020501E.ai
Figure SCALER
n Arguments
Table Arguments of SCALER
IN REAL Input value (a value in the range from 0.0 to 100.0)
IN SH REAL Scale high limit value (output value when input value = 100 [%])
SL REAL Scale low limit value (output value when input value = 0 [%])
OUT OUT REAL Output value
n Description
The SCALER function converts input data (0 to 100%) to the specified scale.
The calculation formula of OUT is as follows:
IN (SH - SL)
OUT = + SL
100.0
C020502E.ai
n Remarks
The OUT calculation formula is the same even if SH < SL. In this case, OUT is calculated as
a linear function with a negative gradient.
Set the SH and SL values such that 32-bit floating point data overflow does not occur when
calculating the output value of OUT, by taking the possible range of IN data (-25% to 125%
in the case of analog input) into consideration.

<C2.5 SCALER (Scaler)> C2-7
n Example
If IN = 60.0 [%], SH = 2000.0 and SL = 1000.0, OUT = 1600.0.
OUT
SH=2000.0
OUT=1600.0
SL=1000.0
0.0
0.0 IN=60.0 100.0 IN
C020503E.ai
Figure Example of SCALER

<C2.6 SEL_R (Real-Type Binary Selector)> C2-8
C2.6 SEL_R (Real-Type Binary Selector)

A SEL_R function is a real-number type selector that selects one of two input values.
SEL_R
SELC
IN1
Q
IN2
C020601E.ai
Figure SEL_R
n Arguments
Table Arguments of SEL_R
SELC BOOL Selector value
Either IN1 or IN2 is output.
OUT Q REAL Input value 1 is output if SELC is FALSE.
Input value 2 is output if SELC is TRUE.
n Description
The SEL_R function is a real-number type selector.
It selects and outputs IN1 or IN2 according to the value of SELC.
n Remarks
This function can be used in new SCS databases created by SENG of R1.01.30 or later.

<C2.7 SEL_T (TIME-Type Binary Selector)> C2-9
C2.7 SEL_T (TIME-Type Binary Selector)

A SEL_T function is a TIME type selector that selects one of two input values.
SEL_T
SELC
IN1
Q
IN2
C020701E.ai
Figure SEL_T
n Arguments
Table Arguments of SEL_T
SELC BOOL Selector value
IN IN1 TIME Input value 1
IN2 TIME Input value 2
Either IN1 or IN2 is output.
OUT Q TIME Input value 1 is output if SELC is FALSE.
Input value 2 is output if SELC is TRUE.
n Description
The SEL_T function is a TIME type selector.
It selects and outputs IN1 or IN2 according to the value of SELC.
n Remarks

<C2.8 IB_TO_V (Converter (IO_BOOL to Data Value))> C2-10
C2.8 IB_TO_V (Converter (IO_BOOL to Data

Value))
An IB_TO_V function retrieves only data values from IO_BOOL-type input values and
outputs the retrieved values.
IB_TO_V
IN V
C020801E.ai
Figure IB_TO_V
n Arguments
Table Arguments of IB_TO_V
IN IN IO_BOOL Input value of IO_BOOL type
OUT V BOOL Data value
n Description
The IB_TO_V function acquires data values from IO_BOOL-type input values and outputs the
acquired values.
n Remarks

<C2.9 IB_TO_S (Converter (IO_BOOL to Data Status))> C2-11
C2.9 IB_TO_S (Converter (IO_BOOL to Data

Status))
An IB_TO_S function retrieves only data status from IO_BOOL-type input values and
outputs the retrieved status.
IB_TO_S
IN STS
C020901E.ai
Figure IB_TO_S
n Arguments
Table Arguments of IB_TO_S
IN IN IO_BOOL Input value of IO_BOOL type
OUT STS BOOL Data status
n Description
The IB_TO_S function acquires data status from IO_BOOL-type input values and outputs the
acquired status.
n Remarks

<C2.10 IR_TO_V (Converter (IO_REAL to Data Value))> C2-12
C2.10 IR_TO_V (Converter (IO_REAL to Data

Value))
An IR_TO_V function retrieves only data values from IO_REAL-type input values and
outputs the retrieved values.
IR_TO_V
IN V
C021001E.ai
Figure IR_TO_V
n Arguments
Table Arguments of IR_TO_V
IN IN IO_REAL Input value of IO_REAL type
OUT V REAL Data value
n Description
The IR_TO_V function acquires data values from IO_REAL-type input values and outputs the
acquired values.
n Remarks

<C2.11 IR_TO_S (Converter (IO_REAL to Data Status))> C2-13
C2.11 IR_TO_S (Converter (IO_REAL to Data

Status))
An IR_TO_S function retrieves only data status from IO_REAL-type input values and
outputs the retrieved status.
IR_TO_S
IN STS
C021101E.ai
Figure IR_TO_S
n Arguments
Table Arguments of IR_TO_S
IN IN IO_REAL Input value of IO_REAL type
OUT STS BOOL Data status
n Description
The IR_TO_S function acquires data status from IO_REAL-type input values and outputs the
acquired status.
n Remarks

<C3.1 REPEATTIMER (Repeat Timer)> C3-1
C3. Safety Function Blocks

This chapter explains the safety function blocks implemented in ProSafe-RS.
The safety function blocks are shown below.
Repeat Timer (REPEATTIMER)
First-Order Lag Filter (FILTER)
First-Order Lag Filter with Data Status (FILTER_S)
1oo2D Analog Voter (ANLG1OO2D)
IO_REAL-Type Analog Voter (ANLGVOTER)
IO_BOOL-Type BOOL Voter (BOOLVOTER)
Analog Input Function Block with Data Status (ANLG_S)
Analog Input (ANLGI)
Velocity Limit Alarm (VEL)
Count Up Counter (CTU)
Count Down Counter (CTD)
Count Up/Down Counter (CTUD)
Converter (Data Value and Status to IO_BOOL-Type Data) (B_TO_IB)
Converter (Data Value and Status to IO_REAL-Type Data) (R_TO_IR)
SEE
ALSO For the information about safety function blocks not explained in this chapter, see the following of the
Workbench in the Workbench Users Guide:
Standard Function Blocks of Language Reference
C3.1 REPEATTIMER (Repeat Timer)

A REPEATTIMER is a function block of repeat timer.
REPEATTIMER
RUN Q
STF
ONT
OFFT
C030101E.ai
Figure REPEATTIMER

n Arguments
Table Arguments of REPEATTIMER
RUN BOOL Output activation switch
Start status flag
STF BOOL TRUE: Start from OFF
IN FALSE: Start from ON
ONT TIME ON period (a multiple of the scan period)
OFFT TIME OFF period (a multiple of the scan period)
OUT Q BOOL Output value
n Description
The REPEATTIMER function block executes a repeat timer function.
The REPEATTIMER function block outputs ON and OFF alternately as long as the output start
switch (RUN) is TRUE. It outputs TRUE as the output value (Q) during the period specified by the
ON period (ONT) and FALSE during the period specified by the OFF period (OFFT). The repeat
interval is the value obtained by adding the ON period and OFF period (ONT + OFFT).
If the output start switch (RUN) becomes FALSE, the output value (Q) is set to FALSE.
If STF is TRUE, the timer starts from the OFF period. If STF is FALSE, the timer starts from the
ON period.
When ONT = 500 msec, OFFT = 1000 msec and scan period = 500 msec
500
msec
RUN
Q when STF = TRUE

(Start from OFF)
Q when STF = FALSE

(Start from ON)
C030102E.ai
Figure Relationship between the Output Start Switch (RUN) and Output Value (Q) (ONT and OFFT are
integral multiples of the scan period)

n Remarks
The ON and OFF periods must be set to integral multiples of the scan period.
The output value (Q) is calculated in each scan period and does not change until the next
scan. For this reason, if the ON/OFF period is set to a value that is not a multiple of the scan
period, the output value (Q) will switch at intervals different from the specified ON/OFF time.
(Whether the period of Q becomes longer or shorter than the specified value depends on
the timing.)
If either the ON period or OFF period is set to 0, the output does not alternate between ON
and OFF; the default value specified with STF is always output.
If the ON period is shorter than the scan period, the ON period is rounded up to the scan
period. The same rule applies to the OFF period as well.
n Specification Difference Between Simulators on PC and Actual SCS
l SCS Simulation Tests

The switching time of on time (ONT) and off time (OFFT) on SCS simulator is different from
actual SCS.
SCS simulator only executes the application logics at 1 second scan period. Therefore, the SCS
simulation can only run at 1 second scan period if the application logic scan period is specified
with a time shorter than 1 second.
When the application logic scan period is shorter than 1 second, the switching will take a longer
time than the indicated parameter.
l Logic Simulation Tests

The input/output parameters of the REPEATTIMER function block operate in the same way as in
the actual SCS.

<C3.2 FILTER (First-Order Lag Filter)> C3-4
C3.2 FILTER (First-Order Lag Filter)

A FILTER function block executes a first-order lag filter function.
FILTER
IN OUT
CFT
C030201E.ai
Figure FILTER
n Arguments
Table Arguments of FILTER
IN REAL Input value
IN
CFT DINT Filter number (0 to 4)
OUT OUT REAL Output value
n Description
The FILTER function block executes a first-order lag filter function.
The first-order lag filter is used to reduce noise in input signals from the process.
The FILTER function block calculates the output according to the following arithmetic expression.
Yn = (1 - ) X + Yn - 1
: Filter constant
X : Input value
Yn : Output value
Yn - 1 : Previous output value (The default value is 0.0.)
The following five filter constants are provided.

Table Filter Constants
Filter number (CFT) Filter constant
0 = 0.0 (No filtering takes place.)
1 = 0.368
2 = 0.5
3 = 0.75
4 = 0.875
If the filter number is a value other than the ones listed above, it is treated as filter number 0.

<C3.2 FILTER (First-Order Lag Filter)> C3-5
Value IN
OUT (=0.5)
Scan period
Time
C030202E.ai
Figure Step Response of the First-order Lag Filter
n Remarks
The time constant of the filter is determined as a combination of the filter number (filter constant)
and the scan period. The larger the filter constant, the longer it takes, and the time constant is
proportional to the scan period.

(Time constant = scan period, where is the filter constant)
1-
C030203E.ai

When the application logic scan period is shorter than 1 second, the output calculation will be
based on 1 execution per second.

The input/output parameters of the FILTER function block operate in the same way as in the
actual SCS.

<C3.3 FILTER_S (First-Order Lag Filter with Data Status)> C3-6
C3.3 FILTER_S (First-Order Lag Filter with Data

Status)
A FILTER_S function block executes a first-order lag filter function. The data status of the
input value is set as the data status of the output value as is.
FILTER_S
IN OUT
CFT VAL
C030301E.ai
Figure FILTER_S
n Arguments
Table Arguments of FILTER_S
IN IO_REAL Input value (with data status)
IN
CFT DINT Filter number (0 to 4)
OUT IO_REAL Output value (with data status)
OUT
VAL REAL Output value (data value only)
n Description
The FILTER_S function block executes a first-order lag filter function.
The first-order lag filter is used to reduce noise in input signals from the process.
The data type of the input value (IN) and output value (OUT) is IO_REAL. The value of the data
status of the input value is set as the data status of the output value as is. VAL is the data value of
OUT.
A FILTER_S function block calculates the output according to the following arithmetic expression.
The value of status does not affect the output calculation.
Yn = (1 - ) X + Yn - 1
: Filter constant
X : Input value
Yn : Output value
Yn - 1 : Previous output value (The default value is 0.0.)

The following five filter constants are provided.
Table Filter Constants
Filter number (CFT) Filter constant
0 = 0.0 (No filtering takes place.)
1 = 0.368
2 = 0.5
3 = 0.75
4 = 0.875
If the filter number is a value other than the ones listed above, it is treated as filter number 0.
Value
IN
OUT (=0.5)
Scan period
Time
C030302E.ai
Figure Step Response of the First-order Lag Filter
n Remarks
Use the FILTER function block if the input value is a real number type. The processing is the
same.
The time constant of the filter is determined as a combination of the filter number (filter constant)
and the scan period. The larger the filter constant, the longer it takes, and the time constant is
proportional to the scan period.

(Time constant = scan period, where is the filter constant)
1-
C030303E.ai


When the application logic scan period is shorter than 1 second, the output calculation will be
based on 1 execution per second.

The input/output parameters of the FILTER_S function block operate in the same way as in the
actual SCS.

<C3.4 ANLG1OO2D (1oo2D Analog Voter)> C3-9
C3.4 ANLG1OO2D (1oo2D Analog Voter)

An ANLG1OO2D function block is a 2-input analog voter with diagnostics. It diagnoses
the data status of two input values and determines the output value.
ANLG1OO2D
IN1 OUT
IN2 NR
DEL NR1
VAL NR2
DLT DIF
C030401E.ai
Figure ANLG1OO2D
n Arguments
Table Arguments of ANLG1OO2D
IN1 IO_REAL Input value 1 (with data status, 0 to 100%)
Allowable range for difference. A range of allowable difference
DEL REAL
between two input values (DEL > 0; UNIT: %)
IN
Fail-safe value. The value output in case the input value is
VAL REAL
erroneous (-25.0 to 125%)
Allowable time. The time to wait for the difference between
DLT TIME the input values to converge to the allowable range (DEL) (an
integral multiple of the scan period)
OUT REAL Output value (value selected with 1oo2D, 0 to 100%)
Indicates whether or not the input value is normal
NR BOOL TRUE: Normal
FALSE: Abnormal (The fail-safe value is output.)
Indicates whether or not input value 1 (IN1) is normal
TRUE: Normal
NR1 BOOL
OUT FALSE: The data status is BAD or the difference between the
input values is larger than the allowable range.
TRUE: Normal
NR2 BOOL
FALSE: The data status is BAD or the difference between the
input values is larger than the allowable range.
DIF REAL Absolute value of the difference between the two input values

n Description
The ANLG1OO2D function block is a 2-input analog voter with diagnostics. It receives two inputs
with data status and determines the output value using the voting method of 1oo2D (one-out-of-
two with diagnostics). By using the ANLG1OO2D function block, it is possible to detect not only
input module failures, but also input value errors.
l Input
IN1 and IN2 are analog inputs (IO_REAL type) with data status. The ANLG1OO2D function
block examines each data status and the difference between input values IN1 and IN2, and
determines the output value (OUT).
DEL is the range of allowable difference between the two input values (DIF). Since the two
input values are measurement values of the same target, they are expected to have almost
the same value. If one of the inputs becomes erroneous, the two values have different
values and an error can be detected. If DEL is set as DEL <= 0%, as long as a difference
exists between the two inputs, no matter how small it is, the input signal will be treated as a
signal exceeds the deviation limit.
DLT is a filter value used in ANLG1OO2D function block to allow the difference between
the two input values (DIF) that exceeds the deviation limit (DEL) elapse for a specified time.
If DLT is set with 0, as soon as one input is different from another input, the fail-safe value
will be output. By setting an appropriate value for DLT, it is possible to avoid the input of
the function block becomes error over the transient noises. If the input of the function block
becomes error, the fail-safe value will be output.
VAL is the value output if the ANLG1OO2D function block judges an input error. Specify a
value in the range from -25.0 to 125% for VAL. If a value smaller than -25.0% is specified, it
is treated as -25.0%. If a value larger than 125% is specified, it is treated as 125%.
l Output
OUT is the output value created by the ANLG1OO2D function block according to the 1oo2D
vote. If the ANLG1OO2D function block considers the input to be normal, the output value
of either IN1 or IN2 is created. If the ANLG1OO2D function block considers the input to be
abnormal, the fail-safe value (VAL) is used to create the output. The initial value of OUT is
IN1.
NR is the resulting output of the ANLG1OO2D function blocks judgment of whether the
inputs are normal or abnormal. If the inputs are normal, NR is set to TRUE. If the inputs
are judged abnormal, NR is set to FALSE and OUT produces output based on the fail-safe
value (VAL).
NR1 is the resulting output of the ANLG1OO2D function blocks judgment of whether the
input value 1 (IN1) is normal or abnormal. If the data status of input value 1 (IN1) is GOOD
and the difference between the two input values (DIF) is within the acceptable range, input
value1 (IN1) is considered as normal and NR1 is set to TRUE. If input value 1 (IN1) is
considered as abnormal, NR1 is set to FALSE.
NR2 is the resulting output of the ANLG1OO2D function blocks judgment of whether input
value 2 (IN2) is normal or abnormal. The classification of normal or abnormal is the same as
for NR1.
DIF is the absolute value of the difference between input value 1 (IN1) and input value 2
(IN2). The ANLG1OO2D function block calculates the difference between the input values
regardless of each status of the input values.

l Relationship between Inputs and Output
The ANLG1OO2D function block examines the data status of the inputs and the difference
between input values IN1 and IN2 to determine the output. The ANLG1OO2D function block
judges that there is an input error and outputs the fail-safe value (VAL) if the condition where the
difference between the input values (DIF) is larger than the allowable range (DEL) continues for
longer than the allowable time (DLT).
The table below summarizes the relationship between the inputs and outputs.
Table Relationship between Inputs and Outputs of an ANLG1OO2 Function Block
Inputs Outputs
Input value Continued
Data status OUT NR NR1 NR2
difference time
IN1 or IN2, whichever is
DIF <= DEL TRUE TRUE TRUE
closer to the previous output
GOOD for both Continued time IN1 or IN2, whichever is
TRUE TRUE TRUE
inputs <= DLT closer to the previous output
DIF > DEL
Continued time
Fail-safe value FALSE FALSE FALSE
> DLR
GOOD for one input and BAD for the other input Input value with GOOD data
(Example: data status of IN1 is BAD, data status of status (IN2 in the example to TRUE FALSE TRUE
IN2 is GOOD) the left)
BAD for both inputs Fail-safe value FALSE FALSE FALSE
l Operation when Inputs are Normal

If the data status of both inputs is GOOD and the difference between the input values is within
the acceptable range, the ANLG1OO2D function block determines that the inputs are normal.
Specifically, the input is considered to be normal under the following conditions.
IN1.status = IN2.status = TRUE, and

DIF <= DEL
If the inputs are normal, the ANLG1OO2D function block outputs the input value closer to the
previous output value. Since output value (OUT) is normal, NR is set to TRUE. Moreover, since
both input values (IN1 and IN2) are normal, both NR1 and NR2 are set to TRUE.
value
IN1
IN2
Output
value
(OUT)
DEL
DIF
time
NR,NR1,NR2 T
F
C030402E.ai
Figure Operation when Inputs are Normal (Normal Operation)

l Operation when Input Data Status is BAD
If the data status of one input becomes BAD, the ANLG1OO2D function block outputs the value
from the other input. In this case, NRn corresponding to the input value whose data status is BAD
(output NR1 if the data status of IN1 is BAD, and NR2 if the data status of IN2 is BAD) becomes
FALSE. The output of NRm corresponding to the input value whose data status is GOOD (output
NR1 if the data status of IN1 is GOOD, and NR2 if the data status of IN2 is GOOD) and output of
NR remain TRUE.
If the data status of both inputs becomes BAD, the ANLG1OO2D function block outputs the fail-
safe value (VAL). NR, NR1 and NR2 become FALSE.
The figure below shows an example of output when the data status of both inputs becomes BAD.
value
Output
value
(OUT)
IN1
IN2
Fail-safe value
(VAL)
time
T
IN1.status
F
T
IN2.status
F
T
NR
F
T
NR1
F
T
NR2
F
Scan period
C030403E.ai
Figure Operation when Input Data Status is BAD

l Operation when the Difference between Input Values Exceeds the Allowable
Range
If the difference between the input values is greater than the allowable range (DEL), it is likely that
either one of the inputs has become erroneous. In order to avoid cases of temporary errors due
to noise, etc., however, the ANGL1OO2D function block does not judge an input to be erroneous
until the error status continues for more than the allowable time (DLT).
The operation is the same as under normal circumstances until the allowable time (DLT) is
exceeded. The input value closer to the previous output value is output and TRUE is output for
NR, NR1 and NR2.
If the status where the absolute value of the difference between the input values exceeds the
allowable range (DEL) continues longer than the allowable time (DLT), the ANLG1OO2D function
block judges that the inputs have become abnormal and outputs the fail-safe value (VAL). FALSE
is output for NR, NR1 and NR2.
Note that when the absolute value of the difference between the input values exceeds the
allowable range and the data status of the input (IN1 or IN2) becomes BAD, the time period in
which the input is BAD is not included in the calculation of time where the difference exceeds the
allowable range. If the allowable range is still exceeded when the data status of the input (IN1 or
IN2) recovers to GOOD, the elapsed time before the data status became BAD is added to the
calculation of time where the difference exceeds the allowable range.
value
IN1
Output
IN2 value
(OUT)
Fail-safe value
(VAL)
DEL
DLT
DIF
time
T
NR, NR1,NR2
F
Scan period
C030404E.ai
Figure Operation when the Difference between Input Values Exceeds the Allowable Range
n Remarks
Set values such that the input value at error occurrence in each input channel and the fail-
safe value (VAL) of the ANLG1OO2D function block match each other. This should be done
because the ANLG1OO2D function block uses the fail-safe value (VAL) rather than the input
value at error occurrence set for an input channel if the input channel becomes abnormal.
Specify an integral multiple of the scan period for the allowable time (DLT). If the specified
value is not an integral multiple of the scan period, the fail-safe value is output after a time
equivalent to the first integral multiple of the scan period has passed since DLT elapsed.


The time-up timing of allowable time (DLT) on SCS simulator and on actual SCS is different.
SCS simulator test only executes the application logics at 1 second scan period. Therefore,
the SCS simulation can only run at 1 second scan period if the application logic scan period is
specified with a time shorter than 1 second.
When the application logic scan period is shorter than 1 second, the time-up will take a longer

The input/output parameters of the ANALG1OO2D function block operate in the same way as in
the actual SCS.

<C3.5 ANLGVOTER (IO_REAL-Type Analog Voter)> C3-15
C3.5 ANLGVOTER (IO_REAL-Type Analog Voter)

An ANLGVOTER function block is a 3-input analog voter. It receives three input values
with data status and outputs the medium value of these input values or the fail-safe value.
ANLGVOTER
IN1 OUT
IN2 NR
IN3 NR1
DEL DIF1
VAL NR2
DLT DIF2
NR3
DIF3
C030501E.ai
Figure ANLGVOTER
n Arguments
Table Arguments of ANLGVOTER
Allowable range (allowable error). Tolerant deviation between an
DEL REAL
IN input and the medium value (DEL > 0%; 0% -100%).
Fail-safe value. The value output in case the input value is
VAL REAL
erroneous (-25.0 to 125%)
Allowable time. The time to wait for the difference between
DLT TIME the input values to converge to the allowable range (DEL) (an
integral multiple of the scan period)
OUT REAL Output value (medium value selected with 2oo3, 0 to 100%)
Indicates whether or not the output value is normal
TRUE: Normal
NR1 BOOL
output value and input value 1 is larger than the allowable range.
Difference between the output value (OUT) and input value 1
DIF1 REAL
(IN1)
OUT Indicates whether or not input value 2 (IN2) is normal
TRUE: Normal
NR2 BOOL
DIF2 REAL
(IN2)
TRUE: Normal
NR3 BOOL
DIF3 REAL
(IN3)

n Description
The ANLGVOTER function block is a 3-input analog voter. It receives three inputs with data
status and determines the medium value to be output using the voting method of 2oo3 (two-out-
of-three). By using an ANLGVOTER function block, it is possible to detect input module failures.
IN1, IN2 and IN3 are analog inputs (IO_REAL type) with data status.
DEL is the range of acceptable differences between the median value and each of the
input values. Since the three input values are measurement values of the same target, they
are expected to have almost the same value. If one of the inputs becomes erroneous, a
distinctive difference is generated between the input value and the median value so that an
error can be detected.
Input n is regarded as normal if the difference between input value INn and the median
value is as follows.
-DEL/2 DIFn +DEL/2
DIFn = INn - median value {n = 1, 2 or 3}
If DEL <= 0%, as long as a difference exists between an input and the median value, no
matter how small it is, the input signal will be treated as a signal that it has exceeded the
deviation limit.
VAL is the value output if the ANLGVOTER function block judges an input error. Specify a
value in the range from -25.0 to 125% for VAL. If a value smaller than -25.0% is specified, it
is treated as -25.0%. If a value larger than 125% is specified, it is treated as 125%.
DLT is a filter value used in ANLGVOTER function block to allow the deviation exceeds the
deviation limit (DEL) elapse for a specified time. If DLT is set with 0, as soon as the deviation
between an input and the medium value exceeds the deviation limit between an input and
the medium value, the fail-safe value will be output. By setting an appropriate value for DLT,
it is possible to avoid the input of the function block becomes error over the transient noises.

l Relationship between Inputs and Output
The ANLGVOTER function block examines the data status of the input values and the difference
between the medium value and the input values (IN1, IN2 and IN3) to determine the output
value (OUT). The ANLGVOTER function block judges an input error and outputs the fail-safe
value (VAL) rather than the input value if the condition where the difference between the medium
value and each of the input values is larger than the allowable range continues longer than the
allowable time (DLT).
The table below summarizes the relationship between the inputs and outputs.
Table Relationship between Inputs and Outputs of an ANLGVOTER Function Block
Inputs Outputs
Input value NR2,
Data status Continued time OUT NR NR1
difference NR3
All inputs are within the range The medium value of
TRUE TRUE TRUE
- DEL/2 DIFn + DEL/2 {n = 1, 2, 3} IN1, IN2 and IN3
Only one input is outside Continued time DLT The medium value of TRUE TRUE TRUE
the range (Example: IN1 IN1, IN2 and IN3
GOOD for all
inputs is outside the range) Continued time > DLT Either IN2 or IN3 (*1) TRUE FALSE TRUE
The medium value of
Two inputs are outside Continued time DLT TRUE TRUE TRUE
IN1, IN2 and IN3
the range
Continued time > DLT Fail-safe value (VAL) FALSE FALSE FALSE
The difference between the inputs whose data
One input is status is GOOD is within the range. Either IN2 or IN3 (*1) TRUE FALSE TRUE
BAD and two In the example to the left, |IN2 - IN3| DEL
inputs are GOOD
(Example: IN1 is The difference between Continued time DLT Either IN2 or IN3 (*1) TRUE FALSE TRUE
BAD and IN2 and the inputs whose data
In3 are GOOD) status is GOOD is
outside the range. Continued time > DLT Fail-safe value (VAL) FALSE FALSE FALSE
FALSE FALSE
BAD for two or more inputs Fail-safe value (VAL) FALSE
(*2) (*2)
*1: The medium value of the fail-safe value, IN2 and IN3 is output; as a result, either IN2 or IN3 is output.
*2: If the data status is GOOD only for one input, it is not possible to judge that the data value is correct; FALSE is output for NR1,
NR2 and NR3.

l Operation when Inputs are Normal
If the data status of all the inputs is GOOD and the difference among the input values is within the
allowable range, the ANLGVOTER function block judges that the inputs are normal. Specifically,
the inputs are judged to be normal under the following conditions.
IN1.status = IN2.status = IN3.status = TRUE, and

- DEL/2 DIFn DEL/2 {n = 1, 2, 3}
If the inputs are normal, the ANLGVOTER function block selects the medium value of the three
input values and calculates the difference between the medium value and each of the input
values (DIFn {n = 1, 2 and 3}). Since all DIFn values are within the allowable range (-DEL2
DIFn +DEL/2), all the input values are judged normal and the medium value is selected as
the output value (OUT). Since the normal output value (OUT) is output, NR is set to TRUE.
Moreover, since all the inputs are normal, NR1, NR2 and NR3 are set to TRUE.
Example: If IN1 = 10.0, IN2 = 12.0, IN3 = 13.0, and DEL = 6.0, the medium value becomes
12.0 (value of IN2). The difference from the medium value is: DIF1 = -2.0, DIF2 = 0.0 and DIF3
= 1.0. Since -DEL/2 DIF1 +DEL/2, IN1 is regarded as normal. Similarly, IN2 and IN3 are
also regarded as normal. The ANLGVOTER function block judges all the inputs as normal, and
outputs OUT = 12.0, NR = TRUE, NR1 = TRUE, NR 2 = TRUE and NR3 = TRUE.
Output
value
value
(OUT)
IN1
IN2
IN3
+DEL/2
DIF1
DIF2
0 time
DIF3
-DEL/2
NR,NR1,NR2,NR3 T
F
C030502E.ai
Figure Operation when Inputs are Normal (Normal Operation)

l Operation when Input Data Status is BAD
Input errors that can be detected by sensors and input modules are notified as BAD data status
of an input value. The ANLGVOTER function block uses the fail-safe value, rather than input
value, for such input, because erroneous input is clear.
If the data status of one input becomes BAD, the ANLGVOTER function block examines the
difference between the two input values whose data status is GOOD and outputs one of them
(specifically, the medium value of the remaining two input values and the fail-safe value becomes
the output value (OUT)).
If the difference between the input values whose data status is GOOD is within the allowable
range, the output value is normal, thus NR becomes TRUE. NRn corresponding to the abnormal
input value becomes FALSE and NRm corresponding to the two normal input values become
TRUE {n, m = 1, 2 or 3}.
If the status where the difference between the input values whose data status is GOOD exceeds
the allowable range (|difference between GOOD input values| > DEL) continues longer than
the allowable time (DLT), the ANLGVOTER function block judges that the inputs have become
abnormal and outputs the fail-safe value (VAL). FALSE is output for NR and NRn {n = 1, 2 and 3}.
If the data status of two or more inputs is BAD, the ANLGVOTER function block judges that a
normal value cannot be output and outputs the fail-safe value (VAL).
Since the output value is abnormal, NR becomes FALSE. Moreover, all NRn becomes FALSE {n
= 1, 2 and 3}.
value
Output
value
IN1 (OUT)
IN2
IN3
VAL
time
T
IN1.status
F
T
IN2.status
F
T
NR
F
NR1 T
F
IN3.status and NR3
T are omitted.
NR2
F
C030503E.ai
Figure Operation when Input Data Status is BAD

l Operation when the Difference between Input Values Exceeds the Allowable
Range
If there is a significant difference among the input values, it is likely that one of the inputs has
become erroneous. In order to avoid cases of temporary errors due to noise, etc., however,
the ANLGVOTER function block does not judge an input to be erroneous until the error status
continues for more than the allowable time (DLT).
If the status where the difference between only one input value and the medium value (DIFn)
exceeds the allowable range (|DIFn| > DEL/2) continues longer than the allowable time (DLT),
the ANLGVOTER function block judges that only the input value in question is erroneous and
outputs the medium value.
NRn corresponding to the input value (INn) that is significantly different from the medium value
becomes FALSE. Since the output and other input values are normal, NR and NRm become
TRUE {n, m = 1, 2, 3 and n m}.
If the status where the difference between the medium value and two out of the three input values
(DIFn) {n = 1, 2, or 3} exceeds the allowable range (|DIFn| > DEL/2) continues longer than the
allowable time (DLT), the ANLGVOTER function block outputs the fail-safe value (VAL) {n = 1, 2
or 3}.
Since the output and all input values are abnormal, NR, NR1, NR2 and NR3 become FALSE.
Note that when the difference between the input values and the medium value (DIFn) exceeds
the allowable range and the data status of the input values (INn) becomes BAD, the time period
in which the input is BAD is not included in the calculation of time where the difference exceeds
the allowable range. If the allowable range is still exceeded when the data status of the input
(INn) recovers to GOOD, the elapsed time before the data status became BAD is added to the
calculation of time where the difference exceeds the allowable range.
value
IN1
IN2 Output
value
IN3 (OUT)
VAL
DLT
+DEL/2
DIF1
DIF2
0 time
DIF3
-DEL/2
DLT
NR, NR1,NR2 T
F
NR3 T
F
C030504E.ai
Figure Operation when the Difference between Input Values Exceeds the Allowable Range

n Remarks
Set values such that the input value at error occurrence in each input channel and the
fail-safe value (VAL) of the ANLGVOTER function block match each other. This should be
done because the ANLGVOTER function block uses VAL rather than the input value at error
occurrence set for an input channel if the input channel becomes abnormal.
Specify an integral multiple of the scan period for the allowable time (DLT). If the specified
value is not an integral multiple of the scan period, the fail-safe value is output after a time
equivalent to the first integral multiple of the scan period has passed since DLT elapsed.

The time-up timing of allowable time (DLT) on SCS simulator and on actual SCS is different.

The input/output parameters of the ANLGVOTER function block operate in the same way as in
the actual SCS.

<C3.6 BOOLVOTER (IO_BOOL-Type BOOL Voter)> C3-22
C3.6 BOOLVOTER (IO_BOOL-Type BOOL Voter)

A BOOLVOTER function block is a 3-input BOOL voter. It receives three input values with
data status and outputs a value selected from these input values or the fail-safe value.
BOOLVOTER
IN1 Q
IN2 NR
IN3 NR1
VAL NR2
NR3
C030601E.ai
Figure BOOLVOTER
n Arguments
Table Arguments of BOOLVOTER
IN1 IO_BOOL Input value 1 (with data status)
IN2 IO_BOOL Input value 2 (with data status)
IN IN3 IO_BOOL Input value 3 (with data status)
Fail-safe value. The value output in case the data status of input
VAL BOOL
value is not GOOD.
Q BOOL Output value (value selected with 2oo3)
Indicates whether or not output value is normal
TRUE: Normal
NR1 BOOL
FALSE: The data status is BAD or the data value is different
from the other input values.
OUT
TRUE: Normal
NR2 BOOL
TRUE: Normal
NR3 BOOL

n Description
A BOOLVOTER function block is a 3-input BOOL voter. It receives three input values with data
status and outputs one value selected as the value of at least two out of the three inputs (two-
out-of three: 2oo3) via the output (Q). By using the BOOLVOTER function block, it is possible to
detect not only input module failures, but also errors in input values INn {n = 1, 2 or 3} received
from sensors.
IN1, IN2 and IN3 are Boolean inputs (IO_BOOL type) with data status.
If the status of input INn is BAD, NRn is set to FALSE.
The data status of an input signal is determined by the input modules under normal
circumstances. The BAD data status indicates that an input processing error was detected
in the input module.
If the data status of all the inputs is GOOD and all the input values are the same, the output
is the same value as the inputs. NR and all NRn become TRUE. This is the normal status {n
= 1, 2 and 3}.
If the data status of two inputs is GOOD and their input values are the same, that value is
output. NR and NRn of the inputs whose data status is GOOD become TRUE. NRm of the
input whose data status is BAD becomes FALSE {n, m = 1, 2 or 3}.
If the data status of two inputs is GOOD but the inputs have different values, the VAL value
is output from Q. NR and all NRn become FALSE {n = 1, 2 or 3}.
If the data status of two or more inputs is BAD, the VAL value is output from Q. NR and all
NRn become FALSE {n = 1, 2 and 3}.
l Relationship between Inputs and Outputs

The BOOLVOTER function block examines the data status of the input values and the difference
between the input values to determine the output. The table below summarizes the relationship
between the inputs and outputs.
Table Relationship between Inputs and Outputs of BOOLVOTER Function Block
Inputs Outputs
Data status Input value difference Q NR NR1 NR2, NR3
All inputs have the same The value of IN1, IN2
TRUE TRUE TRUE
value (IN1 = IN2 = IN3). and IN3
GOOD for all inputs One of the inputs has a
The value of IN2 and
different value than the other TRUE FALSE TRUE
IN3
two (IN1 IN2, IN3)
Inputs whose data status is
The value of IN2 and
BAD for one input and GOOD GOOD have the same value TRUE FALSE TRUE
IN3
for the other inputs (Example: (IN2 = IN3)
IN1 is BAD, IN2 and IN3 are Inputs whose data status is
GOOD) GOOD have different values Fail-safe value (VAL) FALSE FALSE FALSE
(IN2 IN3)
BAD for two or more inputs Fail-safe value (VAL) FALSE FALSE FALSE
n Remarks
Set values such that the input value at error occurrence in each input channel and the fail-safe
value (VAL) of the BOOLVOTER function block match each other. This should be done because
the BOOLVOTER function block uses VAL rather than the input value at error occurrence set for
an input channel if the input channel becomes abnormal.


The input/output parameters of the BOOLVOTER function block operate in the same way as in
the actual SCS.

The input/output parameters of the BOOLVOTER function block operate in the same way as in
the actual SCS.

<C3.7 ANLG_S (Analog Input Function Block with Data Status)> C3-25
C3.7 ANLG_S (Analog Input Function Block with

Data Status)
An ANLG_S function block converts the scale of the analog input (IN), and then outputs
the converted analog output (OUT) and data status (STS) corresponding to the analog
input (IN).
ANLG_S
IN OUT
SH STS
SL NHTR
HH NHHH
PH NLLL
PL NLTR
LL
HYS
TRDT
PADT
SOER
ID
C030701E.ai
Figure ANLG_S

n Arguments
Table Arguments of ANLG_S
IN IO_REAL Analog input (data value: 0 to 100%)
SH REAL Scale high limit (engineering data)
SL REAL Scale low limit (engineering data)
HH REAL Setting level of HI trip (engineering data)
PH REAL Setting level of HI pre-alarm (engineering data)
PL REAL Setting level of LO pre-alarm (engineering data)
LL REAL Setting level of LO trip (engineering data)
Hysteresis (HYS 0; unit is %). If HYS is set as HYS < 0, it acts as
HYS REAL
HYS = 0.
IN
The minimum time period treated as trip occurrence (Must be an
integer multiple of the scan period)
TRDT TIME
If a trip event continues for the time period specified here, the trip
Occurred is stored in NHTR and NLTR.
The minimum time period treated as pre-alarm occurrence (Must be
an integer multiple of the scan period)
PADT TIME
If a pre-alarm event continues for the time period specified here, the
trip Occurred is stored in NHHH and NLLL.
SOER BOOL SOER setting
Character string of up to 32 single-byte or 16 double-byte characters
ID STRING
specified for SOER
OUT REAL Analog output (scale already converted)
Data status (data status of IN)
STS BOOL TRUE: GOOD
FALSE: BAD
HI trip occurrence flag
NHTR BOOL TRUE: Normal
FALSE: Occurred
OUT HI pre-alarm occurrence flag
NHHH BOOL TRUE: Normal
FALSE: Occurred
LO pre-alarm occurrence flag
NLLL BOOL TRUE: Normal
FALSE: Occurred
LO trip occurrence flag
NLTR BOOL TRUE: Normal
FALSE: Occurred

n Description
An ANLG_S function block converts the scale of the analog input (IN), and then outputs the
converted analog output (OUT) and data status (STS) corresponding to the analog input (IN). It
compares this output value (OUT) with four types of threshold values (HH, PH, PL and LL) and
outputs an alarm status (NHTR, NHHH, NLLL or NLTR). Each alarm condition is only set as
having occurred (FALSE) if the alarm condition continues for a specified period of time (TRDT
or PADT) or longer. If TRUE is specified for SOER, an SOE event is generated when a trip/pre-
alarm occurs or the system recovers from it.
It can be referenced using a tag name from CENTUM by defining the tag name for the instance
of the ANLG_S function block. If the data status (STS) becomes FALSE (BAD), an IOP process
alarm is generated, which can be confirmed on an HIS.
l Scale Conversion
IN is normalized data in the range from 0.0 to 100.0%. The ANLG_S function block uses scale
high limit (SH) and scale low limit (SL) to convert IN into physical units and outputs this value as
OUT.
IN.v x (SH - SL)
OUT = + SL
100.0
C030702E.ai
l Output of Data Status of IN and Process Alarm Notification

An ANLG_S function block outputs the data status of IN (IN.status) as is as STS. If IN.status
becomes BAD, STS changes from TRUE to FALSE and an IOP (input open) process alarm is
generated. Conversely, if STS changes from FALSE to TRUE, an IOP recovery process alarm is
generated. Process alarms can be confirmed on an HIS.
l Trip Level Check

An ANLG_S function block monitors the condition where OUT is greater than the HI trip setting
level (HH). If this condition continues for the time period treated as trip occurrence (TRDT) or
longer, it sets the HI trip occurrence flag (NHTR) to FALSE. The function block also monitors the
condition where OUT is smaller than the LO trip setting level (LL). If this condition continues for
the time period specified by TRDT or longer, it sets the LO trip occurrence flag (NLTR) to FALSE.
The ANLG_S function block sets NHTR to TRUE if OUT becomes equal to or smaller than the
HI trip detection value obtained by subtracting the hysteresis value during a HI trip occurrence.
Similarly, it sets NLTR to TRUE if OUT becomes equal to or greater than the LO trip detection
value obtained by subtracting the hysteresis value during a LO trip occurrence.
The table below shows the conditions for the NHTR and NLTR values to change values.
Table Relationship between OUT and NHTR/NLTR
Argument Condition Value
The condition of OUT > HH continues for the
FALSE
time period specified by TRDT or longer
NHTR
OUT HH HYS x (SH - SL)/100.0 TRUE
Otherwise hold
The condition OUT < LL continues for the time
FALSE
period specified by TRDT or longer
NLTR
OUT LL + HYS x (SH - SL)/100.0 TRUE
Otherwise hold

TRDT (minimum time period treated as trip occurrence) is applied only at trip occurrence.
HYS (hysteresis) is applied at recovery from a trip.
If it is desired to set NHTR to TRUE (Normal) at all times, set HH greater than the maximum
value the OUT value can take.
If it is desired to set NLTR to TRUE (Normal) at all times, set LL smaller than the minimum
A false trip that might be generated in the following circumstance can be prevented by
setting the hysteresis value to HYS.
- When zero (0) is set to TRDT.
- When a value other than zero (0) is set to TRDT, and the input signal is fluctuating
around the trip detection level of ANLG_S.
Specify the hysteresis (HYS) as a percentage of the scale. The recommended value is
2.0%.
OUT
HH
HYS (SH - SL)
100.0
TRDT
TRDT
HYS (SH - SL)

100.0
LL
time
T
NHTR
F
T
NLTR
F
C030703E.ai
Figure Relationship between OUT and Trip Level Check

l Pre-alarm Level Check
An ANLG_S function block monitors the condition where OUT is greater than the HI pre-alarm
setting level (PH). If this condition continues for the time period treated as pre-alarm occurrence
(PADT) or longer, it sets the HI pre-alarm occurrence flag (NHHH) to FALSE. The function block
also monitors the condition where OUT is smaller than the LO pre-alarm setting level (PL). If
this condition continues for the time period specified by PADT or longer, it sets the LO pre-alarm
occurrence flag (NLLL) to FALSE.
The ANLG_S function block sets NHHH to TRUE if OUT becomes equal to or smaller than the
HI pre-alarm detection value obtained by subtracting the hysteresis value during a HI pre-alarm
occurrence. Similarly, it sets NLLL to TRUE if OUT becomes equal to or greater than the LO
pre-alarm detection value obtained by subtracting the hysteresis value during a LO pre-alarm
occurrence.
The table below shows the conditions for NHHH and NLLL values to change.
Table Relationship between OUT and NHHH/NLLL
Argument Condition Value
The condition of OUT > PH continues for the time period specified by PADT or longer FALSE
NHHH OUT PH HYS x (SH - SL)/100.0 TRUE
Other hold
The condition of OUT < PL continues for the time period specified by PADT or longer FALSE
NLLL OUT PL + HYS x (SH - SL)/100.0 TRUE
Other hold
PADT (minimum time period treated as pre-alarm occurrence) is applied only at pre-alarm
occurrence. HYS (hysteresis) is applied at recovery from an pre-alarm.
If it is desired to set NHHH to TRUE (Normal) at all times, set PH greater than the maximum
If it is desired to set NLLL to TRUE (Normal) at all times, set PL smaller than the minimum

OUT
PH
HYS (SH - SL)
100.0
PADT
PADT
HYS (SH - SL)

100.0
PL
time
T
NHHH
F
T
NLLL
F
C030704E.ai
Figure Relationship between OUT and Pre-alarm Level Check
n SOER Specification
If the argument SOER (SOER setting) is set to TRUE, the ANLG_S function block generates
an event at the timing of alarm (HI/LO pre-alarm or trip) occurrence and recovery. The type of
generated event can be identified in the Message column of SOE Viewer.
Table SOE Events Generated by ANLG_S
Event generation timing ID Message
NHTR value changes from TRUE to FALSE EVT_FALSE
HTPn
NHTR value changes from FALSE to TRUE EVT_TRUE
NHHH value changes from TRUE to FALSE EVT_FALSE
HHHn
NHHH value changes from FALSE to TRUE EVT_TRUE
NLLL value changes from TRUE to FALSE EVT_FALSE
LLLn
NLLL value changes from FALSE to TRUE EVT_TRUE
NLTR value changes from TRUE to FALSE EVT_FALSE
LTPn
NLTR value changes from FALSE to TRUE EVT_TRUE
The character string specified in the ID input parameter is attached to these SOE events.
The character string information is displayed in the Reference column of SOE Viewer.
The STS output parameter (data status of IN) cannot be specified as SOE event. There is
no SOE event related to generation of IOP (input open).

l CENTUM Integration Function
A mapping block of the ANLG_S function block (S_ANLG_S) is created by defining the tag name
in Tag Name Builder of the SENG. This allows referencing the function block using the tag name
from CENTUM. The following process alarms can be confirmed in the HIS.
Generation of / recovery from IOP (input open)
Generation of / recovery from HI and LO pre-alarms, HI and LO trips
The table below shows process alarm notifications at generation of/recovery from HI and LO pre-
alarms and HI and LO trips.
Table Process Alarms at Generation of HI and LO Pre-alarms and Trips
Event generation timing Process alarm
NHTR value changes from TRUE to FALSE HTRP generation
NHTR value changes from FALSE to TRUE HTRP recovery
NHHH value changes from TRUE to FALSE HHH generation
NHHH value changes from FALSE to TRUE HHH recovery
NLLL value changes from TRUE to FALSE LLL generation
NLLL value changes from FALSE to TRUE LLL recovery
NLTR value changes from TRUE to FALSE LTRP generation
NLTR value changes from FALSE to TRUE LTRP recovery
IMPORTANT
As shown in above table, in ANLG_S, the parameter names indicating conditions of alarm
occurrence and character strings in process alarms indicating generation of / recovery from HI
and LO pre-alarms and trips are different.
SEE
ALSO For the specification of mapping blocks, see the following:
n Data Items of Mapping Blocks Associated with Analog Input Function Blocks with Data Status (ANLG_
S) in D2.3, Tag Name Interfaces of Function Blocks

n Remarks
Since the ANLG_S function block performs scale conversion, there is no need to connect a
SCALER function before ANLG_S.
To filter an analog input, connect a FILTER or FILTER_S function block before ANLG_S.
This function block can be used in new SCS databases created by SENG of R1.02.00 or
later.
n Example
SEE
ALSO For examples of applications of the ANLG_S function block, see the following:
3.3.1, Use of Analog Input Value of the Engineering Guide (IM 32S01C10-21E)

The trip occurrence time (TRDT) and alarm occurrence time (PADT) on SCS simulator and on
actual SCS are different.

The input/output parameters of the ANLG_S function block operate in the same way as in the
actual SCS.
The CENTUM integration function and SOER function become invalid during a logic simulation
test, however.
Data reference using tag names from CENTUM and notification of process alarms are not
performed.

<C3.8 ANLGI (Analog Input)> C3-33
C3.8 ANLGI (Analog Input)

An ANLGI function block converts the scale of the input value (IN) and calculates the
output value (OUT).
Since the ANLG_S function block consists of the feature of this function block and other
capabilities such as outputting data status, it is recommended to use ANLG_S instead of
this function block.
ANLGI
IN OUT
SH HTRP
SL HHH
HH LLL
PH LTRP
PL
LL
HYS
SOER
ID
C030801E.ai
Figure ANLGI
n Arguments
Table Arguments of ANLGI
IN REAL Input value (0 to 100%)
SH REAL Scale high limit (engineering data)
SL REAL Scale low limit (engineering data)
HH REAL Setting level of High trip (engineering data)
PH REAL Setting level of High pre-alarm (engineering data)
IN PL REAL Setting level of Low pre-alarm (engineering data)
LL REAL Setting level of Low trip (engineering data)
Hysteresis (HYS 0; 0% -100%). If HYS is set as HYS < 0, it acts
HYS REAL
as HYS = 0.
SOER BOOL SOER setting
Character string of up to 32 single-byte or 16 double-byte
ID STRING
characters specified for SOER
OUT REAL Output value (value after scale conversion)
High trip occurrence flag
HTRP BOOL TRUE: Occurring
FALSE: Not occurred
High pre-alarm occurrence flag
HHH BOOL TRUE: Occurring
OUT FALSE: Not occurred
Low pre-alarm occurrence flag
LLL BOOL TRUE: Occurring
FALSE: Not occurred
Low trip occurrence flag
LTRP BOOL TRUE: Occurring
FALSE: Not occurred

n Description
The ANLGI function block converts the scale of the input value (IN) and calculates the output
value (OUT). It compares this output value with four types of threshold values (HH, PH, PL and
LL) and outputs an alarm status (HTRP, HHH, LLL or LTRP). An SOE event can be generated by
an alarm occurrence. Moreover, it can be referenced using a mapping block from CENTUM by
defining a tag name for the instance of the function block.
l Scale Conversion Function

When an analog input signal is stored in an input variable, the data is normalized to 0.0 to 100.0
%. This function converts the data to the actual amount using the scale high limit (SH) and scale
low limit (SL) values specified by the user.
IN (SH - SL)
OUT = + SL
100.0
C030802E.ai
l Trip Level Check

If the output value (OUT) is greater than the trip setting level on the HI side (HH), the ANLGI
function block outputs TRUE for the trip occurrence status on the HI side (HTRP). If the output
value (OUT) is smaller than the trip setting level on the LO side (LL), the ANLGI function block
outputs TRUE for the trip occurrence status on the LO side (LTRP).
If the output value becomes smaller than the value obtained by subtracting the hysteresis value
(HYS) from the trip setting level on the HI side (HH) while tripping is detected on the HI side, the
ANLGI function block outputs FALSE for HTRP. If the output value becomes greater than the
value obtained by adding the setting level on the LO side (LL) and the hysteresis value (HYS)
while tripping is detected on the LO side, the ANLGI function block outputs FALSE for LTRP.
Table Relationship between OUT and Trip Level Check
Arguments Condition Value
OUT > HH TRUE
HTRP OUT HH - HYS (SH - SL) /100.0 FALSE
Other hold
OUT < LL TRUE
LTRP OUT LL + HYS (SH - SL) /100.0 FALSE
Other hold
If it is desired to set HTRP to FALSE at all times, set HH greater than the maximum value the
OUT value can take.
If it is desired to set LTRP to FALSE at all times, set LL smaller than the minimum value the OUT
value can take.
To prevent the chattering of the trip which is caused by the input value fluctuation around the trip
detection level, specify the hysteresis value (HYS). Specify it as a percentage of the scale. The
recommended value is 2.0%.

OUT
HH
HYS(SH-SL)
100.0
HYS(SH-SL)
100.0
LL
time
T
HTRP
F
T
LTRP
F
C030803E.ai
Figure Relationship between OUT and Trip Level Check

l Pre-alarm Level Check
If the output value (OUT) is greater than the pre-alarm setting level on the HI side (PH), TRUE
is output for the pre-alarm occurrence status on the HI side (HHH). If the output value (OUT) is
smaller than the pre-alarm setting level on the LO side (PL), TRUE is output as the pre-alarm
occurrence status on the LO side (LLL).
If the output value becomes smaller than the value obtained by subtracting the hysteresis value
(HYS) from the pre-alarm setting level on the HI side (PH) while pre-alarm is detected on the HI
side, the ANLGI function block outputs FALSE for HHH. If the output value becomes greater than
the value obtained by adding the pre-alarm setting level on the LO side (PL) and the hysteresis
value (HYS) while pre-alarm is detected on the LO side, the ANLGI function block outputs FALSE
for LLL.
Table Relationship between OUT and Pre-alarm Level Check
Arguments Condition Value
OUT > PH TRUE
HHH OUT PH - HYS (SH - SL) /100.0 FALSE
Other hold
OUT < PL TRUE
LLL OUT PL + HYS (SH - SL) /100.0 FALSE
Other hold
If it is desired to set HHH to FALSE at all times, set PH greater than the maximum value the OUT
value can take.
If it is desired to set LLL to FALSE at all times, set PL smaller than the minimum value the OUT
value can take.
OUT
PH
HYS (SH - SL)
100.0
HYS (SH - SL)

100.0
PL
time
T
HHH
F
T
LLL
F
C030804E.ai
Figure Relationship between OUT and Pre-alarm Level Check

l SOER Specification
If the SOER specification input parameter is set to TRUE, the ANLGI function block generates
an event at the timing of alarm (pre-alarm or trip) occurrence and recovery. The character string
specified in the ID setting is attached to SOER events generated by the ANLGI function block.

A mapping block of the ANLGI function block (S_ANLGI) is created by defining the tag name in
Tag Name Builder of the SENG. This allows referencing the block data using the tag name from
the HIS of CS 3000. Moreover, each alarm is notified to the HIS and displayed as a process
alarm.
SEE
ALSO For the mapping blocks, see the following:
n Data Items of Mapping Blocks Associated with Analog Input Function Blocks (ANLGI) in D2.3, Tag
Name Interfaces of Function Blocks
n Remarks
Since the ANLGI function block performs scale conversion, there is no need to connect a
SCALER function before ANLGI. To filter an analog input, connect a FILTER or FILTER_S
function block before ANLGI.

The input/output parameters of the ANLGI function block operate in the same way as in the
actual SCS.

The input/output parameters of the ANLGI function block operate in the same way as in the
actual SCS.
The CENTUM integration function and SOER function become invalid, however. Data reference
and notification of process alarms using tag names from CENTUM are not performed.

<C3.9 VEL (Velocity Limit Alarm)> C3-38
C3.9 VEL (Velocity Limit Alarm)

A VEL function block monitors the rate of change of the input value and judges whether or
not the specified rate of change is exceeded.
VEL
IN OUT
VL VELP
HYS VELM
CT
C030901E.ai
Figure VEL
n Arguments
Table Arguments of VEL
IN REAL Input value (0 to 100%)
VL REAL Velocity limit alarm setting level (VL > 0%)
IN
HYS REAL Hysteresis (HYS 0). If HYS is set as HYS < 0, it acts as HYS = 0.
CT TIME Sampling interval
OUT REAL Output value
VEL + alarm occurrence flag
VELP BOOL TRUE: Occurring
OUT FALSE: Not occurred
VEL - alarm occurrence flag
VELM BOOL TRUE: Occurring
FALSE: Not occurred

n Description
The VEL function block monitors the rate of change of the input value and judges whether or not
the specified rate of change is exceeded. Moreover, it can be referenced using a mapping block
from CENTUM by defining a tag name for the instance in question.
The VEL function block monitors the input value (IN) at the sampling intervals (CT) and judges
that the rate of change is exceeded if the absolute value of the amount of input change ( IN)
exceeds the velocity limit alarm setting level (VL). If VL is set as VL 0%, as long as a velocity
exists, no matter how small it is, the input signal will be treated as a signal exceeds the velocity
limit. If IN is greater than VL, the VEL function block outputs TRUE for the VEL + alarm
occurrence status (VELP). If IN is smaller than -VL, the VEL function block outputs TRUE for
the VEL - alarm occurrence status (VELM).
If IN becomes equal to or smaller than VL - HYS while a VEL + alarm is detected, the VEL
function block outputs FALSE for the VEL + alarm occurrence status (VELP).
If IN becomes equal to or greater than - (VL - HYS) while a VEL - alarm is detected, the VEL
function block outputs FALSE for the VEL - alarm occurrence status (VELM).
Using the VEL function block allows detecting a sudden change of the process state and errors in
sensors and transmitters.
IN
< VL - HYS
> VL
time
CT
T
VELP
F
C030902E.ai
Figure Operations of the VEL Function Block
l Sampling Interval (CT)

Specify the interval at which to check the rate of change for the sampling interval (CT). When
the time specified for CT has passed, the difference between the input value before starting the
check and the current input value is calculated. If 0 ms is specified for CT, no velocity limit alarm
is generated. If the specified CT value cannot be divided by the scan period, the rate of change is
checked when the accumulated scan period exceeds CT.

A mapping block of the VEL function block (S_VEL) is created by defining the tag name in Tag
Name Builder of the SENG. This allows referencing the block data using the tag name from the
HIS of CS 3000. Moreover, when a velocity limit alarm is generated or the system recovers from
an alarm, the events are notified to the HIS and displayed as process alarms.
SEE
ALSO For the mapping blocks, see the following:
n Data Items of Mapping Blocks Associated with Velocity Limit Alarm Function Blocks (VEL) in D2.3, Tag
Name Interfaces of Function Blocks
n Remarks
The data type of the IN input argument of a VEL function block is REAL. If it is desired to monitor
velocity limit alarms between an analog input variable (with data status) and an ANLGVOTER
function block, place a FILTER_S function block before the VEL function block and connect the
VAL output argument of the FILTER_S function block to the IN input terminal of the VEL function
block.
The VEL function block must be placed before scale conversion (before a SCALER function or
an ANLGI function block).
IMPORTANT
If a value of a variable connected to the IN input terminal of the VEL function block is changed
via forcing or override, the input value of the VEL function block may change suddenly and a
velocity limit alarm may be generated. To avoid this, be careful not to change the input value of
the VEL function block suddenly when performing the forcing or override operation on a variable
connected to the IN input terminal of the VEL function block.

The sampling interval time (CT) on SCS simulator and on actual SCS is different.
time a than the indicated parameter.

The input/output parameters of the VEL function block operate in the same way as in the actual
SCS.
The CENTUM integration function becomes invalid, however. Data reference using tag names
from CENTUM and notification of process alarms are not performed.

<C3.10 CTU (Count Up Counter)> C3-41
C3.10 CTU (Count Up Counter)

A CTU function block counts up from 0 to the maximum counter value (PV) in increments
of 1 as long as the count input (CU) is TRUE.
CTU
CU
Q
RESE
CV
PV
C031001E.ai
Figure CTU
n Arguments
Table Arguments of CTU
CU BOOL Count input (count up while CU is TRUE)
IN RESE BOOL Reset command (given higher priority than CU)
PV DINT Maximum counter value
Q BOOL TRUE at overflow (CV PV)
OUT
CV DINT Count result
n Description
The CTU function block counts up in increments of 1 at each scan from 0 to the maximum
counter value (PV) as long as the count input (CU) is TRUE. The count result is output for
CV and the default value is 0.
When the counter reaches the maximum value (CV PV), the CTU function block stops
counting up and outputs TRUE for Q.
RESE is a reset command. If RESE becomes TRUE, the counter is reset, Q becomes
FALSE and CV becomes 0. As long as RESE is TRUE, the CTU function block does not
count up even if CU becomes TRUE.
n Remarks
IMPORTANT
The CTU function block of ProSafe-RS and the standard CTU function block of IEC 61131-3
have different count-up conditions, which requires some precaution. The standard CTU function
block of IEC 61131-3 counts up at each rising edge of the count input (CU).
In order to count up the counter value at rising edge, combine an R_TRIG function block and a
CTU function block.

<C3.10 CTU (Count Up Counter)> C3-42

The time required to count from 0 to count-up value (PV) on SCS simulator and on actual SCS is
different.
When the application logic scan period is shorter than 1 second, the count-up will take a longer

The input/output parameters of the CTU function block operate in the same way as in the actual
SCS.

<C3.11 CTD (Count Down Counter)> C3-43
C3.11 CTD (Count Down Counter)

A CTD function block counts down in decrements of 1 at each scan from the initial
counter value (PV) to 0 as long as the count input (CD) is TRUE.
CTD
CD
Q
LOAD
CV
PV
C031001E.ai
Figure CTD
n Arguments
Table Arguments of CTD
CD BOOL Count input (count down while CD is TRUE)
IN LOAD BOOL Load command (given higher priority than CD)
PV DINT Initial counter value
Q BOOL TRUE at underflow (CV 0)
OUT
CV DINT Count result
n Description
The CTD function block counts down in decrements of 1 at each scan from the initial
counter value (PV) to 0 as long as the count input (CD) is TRUE. The count result is output
for CV and the default value is the initial counter value (PV).
When the counter reaches 0 (CV 0), CTD stops counting down and outputs TRUE for Q.
LOAD is a load command. If LOAD becomes TRUE, the counter is loaded, Q becomes
FALSE and CV is reset to PV. As long as LOAD is TRUE, the CTD function block does not
count down even if CD becomes TRUE.
n Remarks
IMPORTANT
The CTD function block of ProSafe-RS and the standard CTD function block of IEC 61131-
3 have different count-down conditions, which requires some precaution. The standard CTD
function block of IEC 61131-3 counts down at each rising edge of the count input (CD).
In order to count down the counter value at rising edge, combine an R_TRIG function block and a
CTD function block.

<C3.11 CTD (Count Down Counter)> C3-44

The time required for reaching count-down value (PV) on SCS simulator and on actual SCS is
different.
When the application logic scan period is shorter than 1 second, the count-down will take a
longer time than the indicated parameter.

The input/output parameters of the CTD function block operate in the same way as in the actual
SCS.

<C3.12 CTUD (Count Up/Down Counter)> C3-45
C3.12 CTUD (Count Up/Down Counter)

A CTUD function block is a counter that is able to count up and down.
CTUD
CU
CD
RESE QU
LOAD QD
PV CV
C031201E.ai
Figure CTUD
n Arguments
Table Arguments of CTUD
CU BOOL Count-up input (count up as long as CU is TRUE)
CD BOOL Count-down input (count down as long as CD is TRUE)
Reset command (given higher priority than CU and CD) (CV = 0
IN RESE BOOL
if RESE is TRUE)
LOAD BOOL Load command (CV = PV if LOAD is TRUE)
PV DINT Maximum counter value
QU BOOL TRUE at overflow status (CV PV)
OUT QD BOOL TRUE at underflow status (CV 0)
CV DINT Count result (0 CV PV)
n Description
The CTUD function block is a counter that can count both up and down. The count result is
output for CV and the default value is 0.
The CTUD function block counts up in increments of 1 at each scan up to the maximum
counter value as long as the count-up input (CU) is TRUE.
It counts down in decrements of 1 at each scan down to 0 as long as the count-down input
(CD) is TRUE.
When the counter reaches the maximum value (CV PV), the CTUD function block stops
counting up and outputs TRUE for QU.
When the counter reaches 0 (CV 0), the CTUD function block stops counting down and
outputs TRUE for QD.
RESE is a reset command. If RESE becomes TRUE, the counter is reset, QU becomes
FALSE and CV becomes 0. As long as RESE is TRUE, the CTUD function block does not
count up or down.
LOAD is a load command. If LOAD becomes TRUE, the counter is loaded, QD becomes
FALSE and CV is reset to PV.

<C3.12 CTUD (Count Up/Down Counter)> C3-46
n Remarks
IMPORTANT
The CTUD function block of ProSafe-RS and the standard CTUD function block of IEC 61131-3
have different count-up/down conditions, which requires some precaution. (The standard CTUD
function block of IEC 61131-3 counts up/down at each rising edge of the count input (CU/CD).)
In order to count up/down the counter value at rising edge, combine an R_TRIG function block
with a CTUD function block.
Do not set both count-up input (CU) and count-down input (CD) to TRUE at the same time. If both
are set to TRUE, the CTUD function block counts up. If CV reaches PV, however, CV outputs
values of PV and PV - 1 repeatedly at each scan.

The time required for reaching count-up or count-down value (PV) on SCS simulator and on
actual SCS is different.
When the application logic scan period is shorter than 1 second, the count up or count-down will
take a longer time than the indicated parameter.

The input/output parameters of the CTUD function block operate in the same way as in the actual
SCS.

<C3.13 B_TO_IB (Converter (Data Value and Status to IO_BOOL-Type Data))> C3-47
C3.13 B_TO_IB (Converter (Data Value and Status

to IO_BOOL-Type Data))
A B_TO_IB function block converts BOOL-type data values and status to IO_BOOL type
and outputs the converted data.
B_TO_IB
V
Q
STS
C031301E.ai
Figure B_TO_IB
n Arguments
Table Arguments of B_TO_IB
V BOOL Data value
IN
STS BOOL Status
OUT Q IO_BOOL Value converted to IO_BOOL type
n Description
The B_TO_IB function block converts input data values and status to IO_BOOL type and outputs
the converted data.
n Remarks
This function block can be used in new SCS databases created by SENG of R1.01.30 or later.

The input/output parameters of the B_TO_IB function block operate in the same way as in the
actual SCS.

The input/output parameters of the B_TO_IB function block operate in the same way as in the
actual SCS.

<C3.14 R_TO_IR (Converter (Data Value and Status to IO_REAL-Type Data))> C3-48
C3.14 R_TO_IR (Converter (Data Value and Status

to IO_REAL-Type Data))
An R_TO_IR function block converts REAL-type data values and status to IO_REAL type
and outputs the converted data.
R_TO_IR
V
Q
STS
C031401E.ai
Figure R_TO_IR
n Arguments
Table Arguments of R_TO_IR
V REAL Data value
IN
STS BOOL Status
OUT Q IO_REAL Value converted to IO_REAL type
n Description
The R_TO_IR function block converts input data values and status to IO_REAL type and outputs
the converted data.
n Remarks

The input/output parameters of the R_TO_IR function block operate in the same way as in the
actual SCS.

The input/output parameters of the R_TO_IR function block operate in the same way as in the
actual SCS.

<C3.15 ANN_FUP (First-up Alarm Annunciator)> C3-49
C3.15 ANN_FUP (First-up Alarm Annunciator)

An ANN_FUP function block has the function to identify the signal that reached the safe
state first in the same group. ANN_FUP outputs an annunciator message only when it is
the first to receive a safe state signal among the ANN_FUP function blocks of the same
group.
ANN_FUP
IN OUT
SS OUT2
GR
C031501E.ai
Figure ANN_FUP
n Arguments
Table Arguments of ANN_FUP
IN BOOL Alarm condition input
Safe state specification
IN SS BOOL TRUE: ETS
FALSE: DTS
Group number: 1 to 256
GR DINT
Enter a fixed value for the group number.
First-up alarm output
OUT BOOL TRUE: First-up alarm status
FALSE: Not in first-up alarm status
OUT
Second output
OUT2 BOOL TRUE: Second to reach safe state
FALSE: Not the second to reach safe state
n Description
The ANN_FUP function block has the following functions.
l First-up Alarm Output

For the first ANN_FUP whose alarm condition input (IN) matches the safe state value (SS) in an
ANN_FUP group to which the same group number (GR) is specified, the first-up alarm output
(OUT) is set to alarm status. At this point, an annunciator message is notified.
There is only one ANN_FUP that can shift to the alarm status within the same group. If an
ANN_FUP in the alarm status already exists in the same group, no other ANN_FUP reaches the
alarm status even if IN and SS match. If IN and SS match in multiple ANN_FUP function blocks in
the same group during the same scan, the ANN_FUP that is executed first will shift to the alarm
status. The ANN_FUPs that are executed later will not shift to the alarm status.

l Second Output
For the second ANN_FUP whose IN and SS match within the same group, the value of the
second output (OUT2) will become TRUE.
For the first ANN_FUP whose IN and SS match, only OUT becomes TRUE while OUT2
remains FALSE.
In the case of the second ANN_FUP whose IN and SS match, only OUT remains FALSE
and OUT2 becomes TRUE.
In the case of subsequent ANN_FUPs whose IN and SS match, both OUT and OUT2
remain FALSE.
l Specification of Group Numbers

Enter a fixed value in the range from 1 to 256 for GR. The group number to which individual
ANN_FUP belongs is specified by GR.
If a value outside the range of 1 to 256 is specified for GR, ANN_FUP does not function. Both
OUT and OUT2 remain FALSE.
IMPORTANT
Typographical errors in group number specification cannot be detected by the system. Therefore,
during the logic test, if the group numbers have been properly specified or not must be carefully
inspected.
l Notification of Annunciator Messages

In the CENTUM integration environment, it is possible to generate annunciator messages to the
HIS. The message character string shall be specified with the Tag Name Builder.
If the value of OUT changes from FALSE to TRUE: An annunciator message is generated to
notify the first up alarm status
If the value of OUT changes from TRUE to FALSE: Notification of recovery from the alarm
status above
Even if OUT2 (second output) becomes TRUE, the annunciator message corresponding to
the ANN_FUP is not notified. If it is desired to notify this secondary alarm with an annunciator
message, connect the OUT2 output to another annunciator function block (ANN).
l Resetting First-up Alarm Status

It is possible to reset the alarm status using the FUP_RST function block. The first-up alarm
status is reset only when the reset signal is generated from the FUP_RST function block under
the condition where IN and SS do not match in all function blocks in the same group.
Even if IN and SS of the ANN_FUP in the first up alarm status do not match any longer, the
reset signal is invalid if IN and SS are matching in other ANN_FUP function blocks within the
same group. OUT of the ANN_FUP in the first-up alarm status remains TRUE.
The reset conditions of the second output (OUT2) are the same as for OUT.

n Remarks
Specify a value in the range from 1 to 256 for the group number (GR). If a value outside
the range (0 or less or 257 or more) is specified to GR, OUT is always FALSE and no
annunciator messages are notified.
Up to 256 groups can be used for a single SCS.
There is no limit to the number of ANN_FUP function blocks that can be specified in one
group.
later.

The input/output parameters of the ANN_FUP operate in the same way as in the actual SCS.

The first-up function does not operate.
The CENTUM integration function is invalid. No annunciator messages are notified.
Table Arguments of ANN_FUP at Logic Simulation Tests
IN/OUT Arguments Value Description
IN Invalid Alarm condition input is invalid.
IN SS Invalid Safe state specification is invalid.
GR Invalid Group number is invalid.
OUT FALSE Always FALSE
OUT
OUT2 FALSE Always FALSE

<C3.16 FUP_RST (First-up Alarm Annunciator Reset)> C3-52
C3.16 FUP_RST (First-up Alarm Annunciator

Reset)
The FUP_RST function block has the function to reset the first-up alarm status set by the
ANN_FUP.
FUP_RST
IN SSI
GR SSO
C031601E.ai
Figure FUP_RST
n Arguments
Table Arguments of FUP_RST
IN BOOL Reset input (valid only at change from FALSE to TRUE)
IN
GR BOOL ANN_FUP group number to be reset (1 to 256)
Whether or not there are any function blocks whose IN and SS match
within the same group
SSI BOOL
TRUE: One or more blocks where IN = SS exist
FALSE: No blocks where IN = SS exist
OUT
Whether or not there are function blocks in the first-up alarm status in the
specified group
SSO BOOL
TRUE: There is at least one function block in the first-up alarm status
FALSE: No function block in the first-up alarm status

n Description
The FUP_RST function block is used to reset the first-up alarm status set by ANN_FUP.
Specify the group number to be reset to GR of the FUP_RST. By changing the reset input (IN)
from FALSE to TRUE, it functions as the reset signal of the first-up alarm status of the target
group. Note that OUT of ANN_FUP in the first-up alarm status is actually reset only when the
reset signal is generated from the FUP_RST function block under the conditions where IN and
SS do not match in all function blocks in the same group.
When the ANN_FUP in the first-up alarm status is reset, an annunciator message is generated to
notify recovery from the alarm status.
l Example
Occurrence of first-up alarm status
(annunciator message notification) Recovery from first-up alarm status
IN T
ANN_FUP[A] F
SS = T
GR = 1 OUT T
F
IN T
ANN_FUP[B] F
SS = T
GR = 1 OUT2 T
F
IN T
ANN_FUP[C] F
SS = T
GR = 1 OUT T
F
FUP_RST IN T
GR = 1 F
t1 t2 t3 t4 t5 t6 t
1scan
C031602E.ai
Figure Generation of and Recovery from First-up Alarm
ANN_FUP [A] first detects matching of IN and SS at t1 and OUT changes to TRUE.
When ANN_FUP [B] detects matching of IN and SS at t2, OUT2 becomes TRUE because
the function block is the second one in the group to detect the matching.
Even if ANN_FUP [C] detects matching of IN and SS at t3, both OUT and OUT2 remain
FALSE because the function block is the third one in the group to detect the matching.
If a reset signal is generated at t4, OUT of ANN_FUP [A] and OUT2 of ANN_FUP [B] remain
TRUE because IN and SS match for all ANN_FUP function blocks.
If a reset signal is generated again at t5, IN and SS of ANN_FUP [A] do not match but IN
and SS of other ANN_FUP function blocks remain matched. Thus, OUT of ANN_FUP [A]
and OUT2 of ANN_FUP [B] remain TRUE.
If a reset signal is generated at t6, IN and SS do not match for all ANN_FUP function blocks.
Thus, OUT of ANN_FUP [A] and OUT2 of ANN_FUP [B] become FALSE.

IMPORTANT
The execution order of ANN_FUP and FUP_RST and the change of signals have the following
relationships.
If FUP_RST is executed first
OUT (OUT2) of ANN_FUP becomes FALSE within the same scan where the IN input
changes from FALSE to TRUE in FUP_RST.
SSO of FUP_RST becomes FALSE in the next scan.
If FUP_RST is executed later
OUT (OUT2) of ANN_FUP becomes FALSE in the next scan after the IN input changes from
FALSE to TRUE in FUP_RST.
SSO of FUP_RST becomes FALSE in the next scan executed after OUT of ANN_FUP
becomes FALSE, meaning 2 scans after IN of FUP_RST becomes TRUE.
l Output
SSI and SSO of FUP_RST are representative values of the input and output statues of all ANN_
FUP function blocks in the group specified by GR. It is possible to use the value of SSO in the
application logic to indicate whether the reset operation is successful or not.
n Remarks
Specify a numerical value in the range from 1 to 256 for the group number (GR). If a value
outside the range for GR (0 or less or 257 or larger) is specified, resetting is not performed.
later.

The Input/output parameters of the FUP_RST operate in the same way as in the actual SCS.

Resetting cannot be performed.
The CENTUM integration function is invalid. ANN_FUP annunciators do not recover either.
Table Arguments of FUP_RST at Logic Simulation Tests
IN Invalid Reset input is invalid.
IN
GR Invalid ANN_FUP group number to be reset is invalid.
SSI Invalid Always FALSE
OUT
SSO Invalid Always FALSE

<C4. Function Blocks for Inter-SCS Communication (Safety FBs)> C4-1
C4. Function Blocks for Inter-SCS

Communication (Safety FBs)
In this chapter, the function blocks used for inter-SCS communication will be explained.
The following function blocks are provided for inter-SCS safety communication.
Inter-SCS Safety Communication BOOL-Type Data Producer (PROD_B)
Inter-SCS Safety Communication INTEGER-Type Data Producer (PROD_I)
Inter-SCS Safety Communication REAL-Type Data Producer (PROD_R)
Inter-SCS Safety Communication BOOL-Type Data Consumer (CONS_B)
Inter-SCS Safety Communication INTEGER-Type Data Consumer (CONS_I)
Inter-SCS Safety Communication REAL-Type Data Consumer (CONS_R)
The following function blocks are provided for SCS link transmission safety
communication.
Link Transmission Data Output Block (LTSND)
Safety Link Transmission Data Input Block (LTRCV)
SEE
ALSO For more information about inter-SCS safety communication, see the following:
A5, Inter-SCS Safety Communication
For more information about SCS link transmission safety communication, see the following:
A6, SCS Link Transmission

<C4.1 PROD_B (Inter-SCS Safety Communication BOOL-Type Data Producer)> C4-2
C4.1 PROD_B (Inter-SCS Safety Communication

BOOL-Type Data Producer)
A PROD_B function block sends BOOL-type data to a CONS_B function block of another
SCS.
PROD_B
IN
BVAR
C040101E.ai
Figure PROD_B
n Arguments
Table Arguments of PROD_B
IN IN BOOL Input value (data transmitted to communicating SCSs)
OUT BVAR COM_BOOL Binding variable for sending BOOL-type data
n Description
The PROD_B function block converts BOOL-type data to a binding variable for sending BOOL-
type data in order to send data to an SCS on the consuming side. This function block is linked
with the output enable operation; no valid data is set to the binding variable at the connection
destination until the output enable operation is performed.
Information on whether or not the transmission succeeded is not notified to this function block.
Use a SYS_DIAG function block to check for error occurrence.
SEE
ALSO For the SYS_DIAG function block, see the following:
C9.6, SYS_DIAG (Diagnostic Information Output)
n Remarks
Make sure that the data type and the numerical value part of the binding variable name in
question match between the sending side and receiving side.

<C4.1 PROD_B (Inter-SCS Safety Communication BOOL-Type Data Producer)> C4-3

The input/output parameters of the PROD_B function block operate in the same way as in the
actual SCS.

The inter-SCS safety communication function is invalid.
Table Arguments of PROD_B at Logic Simulation Test
IN IN Invalid Invalid
Not handled by Inter-SCS safety communication.
OUT BVAR Invalid
The value of IN will be output as BVAR value.

<C4.2 PROD_I (Inter-SCS Safety Communication INTEGER-Type Data Producer)> C4-4
C4.2 PROD_I (Inter-SCS Safety Communication

INTEGER-Type Data Producer)
A PROD_I function block sends DINT-type data to a CONS_I function block of another
SCS.
PROD_I
IN
BVAR
C040201E.ai
Figure PROD_I
n Arguments
Table Arguments of PROD_I
IN IN DINT Input value (data transmitted to communicating SCSs)
OUT BVAR COM_DINT Binding variable for sending DINT-type data
n Description
The PROD_I function block converts DINT-type data to a binding variable for sending DINT-type
data in order to send data to an SCS on the consuming side. This function block is linked with the
output enable operation; no valid data is set to the binding variable at the connection destination
until the output enable operation is performed.
SEE
n Remarks

<C4.2 PROD_I (Inter-SCS Safety Communication INTEGER-Type Data Producer)> C4-5

The input/output parameters of the PROD_I function block operate in the same way as in the
actual SCS.

Table Arguments of PROD_I at Logic Simulation Test
OUT BVAR Invalid

<C4.3 PROD_R (Inter-SCS Safety Communication REAL-Type Data Producer)> C4-6
C4.3 PROD_R (Inter-SCS Safety Communication

REAL-Type Data Producer)
A PROD_R function block sends REAL-type data to a CONS_R function block of another
SCS.
PROD_R
IN
BVAR
C040301E.ai
Figure PROD_R
n Arguments
Table Arguments of PROD_R
IN IN REAL Input value (data transmitted to communicating SCSs)
OUT BVAR COM_REAL Binding variable for sending REAL-type data
n Description
The PROD_R function block converts REAL-type data to a binding variable for sending REAL-
type data in order to send data to an SCS on the consuming side. This function block is linked
with the output enable operation; no valid data is set to the binding variable at the connection
destination until the output enable operation is performed.
SEE
n Remarks
Match data type and the numerical value of binding variable names handled between the
sending side and receiving side.

<C4.3 PROD_R (Inter-SCS Safety Communication REAL-Type Data Producer)> C4-7

The input/output parameters of the PROD_R function block operate in the same way as in the
actual SCS.

Table Arguments of PROD_R at Logic Simulation Test
OUT BVAR Invalid

<C4.4 CONS_B (Inter-SCS Safety Communication BOOL-Type Data Consumer)> C4-8
C4.4 CONS_B (Inter-SCS Safety Communication

BOOL-Type Data Consumer)
A CONS_B function block receives BOOL-type data sent from a PROD_B function block
of another SCS and, if there is no error, outputs the data.
CONS_B
BVAR OUT
VAL
OUTT
DLYT NR
C040401E.ai
Figure CONS_B
n Arguments
Table Arguments of CONS_B
BVAR COM_BOOL Binding variable for receiving BOOL-type data
VAL BOOL Fail-safe value output at error occurrence
Reception interval timeout value: 100 ms to 30 seconds
If a value outside the range is specified, it is treated as 100 ms or
OUTT TIME 30 seconds, whichever is closer.
IN Generates a communication error if reception interval exceeds
OUTT.
Transmission delay timeout value
Generates a communication error if transmission delay time
DLYT TIME
exceeds DLYT.
Transmission delay is not checked if DLYT is set to 0. (*1)
OUT BOOL Output value
OUT The communication status is output.
NR BOOL TRUE: GOOD
FALSE: BAD (including cases where data is not received)
*1: When DLYT is set to 0, the communication cannot be used for safety purpose.

n Description
This function block receives BOOL-type data sent from a PROD_B function block of a producing
side SCS and outputs it via OUT. The communication status is output via NR.
If a communication error occurs, the CONS_B function block generates a diagnostic information
message indicating the communication error and outputs the fail-safe value specified in VAL
via OUT. When the system recovers from the communication error, it generates a diagnostic
information message indicating the recovery and the reception data is output via OUT again.
Create logic for latching and canceling of the output at error occurrence in the application logic.
TRUE
OUT
FALSE

Output fail- Output the value Output fail- Output the value
safe value from the producing safe value from the producing
side side
TRUE
NR
FALSE

Communication Demand from Occurrence Recovery from
start the producing of communi- communication
side cation error error
C040402E.ai
Figure Changes of Output Values at Communication Error Occurrence

l Reception Interval Timeout Value (OUTT) and Transmission Delay Timeout
Value (DLYT)
The reception interval refers to the interval at which the function block on the consuming side
receives data. If data cannot be received within the period specified by the reception interval
timeout value (OUTT), it is regarded as a communication error. Set OUTT to a value in the range
from 100 ms to 30 seconds. (If a value outside the range is specified, it is treated as 100 ms or 30
seconds, whichever is closer.)
OUTT is rounded up to a multiple of the scan period of the SCS on the consuming side. If a value
smaller than the scan period of the SCS on the consuming side is specified as OUTT, the refresh
condition of Binding variables will be checked at every scan period of the SCS on the consuming
side.
The transmission delay is the time after the function block on the producing side transmits data
until the function block on the consuming side receives the data. If the transmission delay time
exceeds the time specified by the transmission delay timeout value (DLYT), it is regarded as
a communication error. If the transmission delay time is shorter than the allowable time error
(negative value), it is also treated as a communication error.
The transmission delay is affected not only by the delays in the communication path, but also by
the scan period of the SCS on the producing side and that of the SCS on the consuming side. A
time discrepancy between the SCS on the producing side and the SCS on the consuming side
can cause errors in the calculation of transmission delay. Set an appropriate value for DLYT
according to the time synchronization method of SCSs.
The normal range of transmission delay is as follows.
-DLYT transmission delay transmission delay timeout value (DLYT)
Producing side Consuming side

Function block Function block
Transmission
delay
Reception
interval
Time
C040403E.ai
Figure Transmission Delay and Reception Interval

l Additional Explanation on Transmission Delay Timeout Value (DLYT) of
Consumer Function Blocks
The transmission delay error of the inter-SCS safety communication should be detected.
A temporary transmission delay error can be found with reception interval timeout (OUTT). A
constant transmission delay error can be found with transmission delay timeout (DLYT). The
general considerations regarding the DLYT setting are detailed as follows:
With IRIG-B time synchronization, consider the time deviation that could be caused by the
IRIG-B Cable or IRIG-B Interface error.
For the SCSs on Vnet/IP network, consider the time deviation that could be caused by the
failure of the SNTP server.
Confirm that the same type of time synchronization is applied to all the SCSs linked by the
inter-SCS safety communication, and then set the DLYT with the consideration of the time
discrepancy of SCSs so as to prevent the false trips.
When setting DLYT to the SCSs crossing domains, the following considerations are also
necessary.
With V net time synchronization, when the communication is crossing a bus converter
(BCV-V), the time may be deviated for 5 seconds, crossing two BCVs in a hierarchical
network, the time may be deviated for 10 seconds. If these deviations may beyond the time
tolerance, it is recommended to apply IRIG-B time synchronization to the SCSs.
If a domain is connected through the wide area network gateway units (CGW), the time
synchronization among the domains need to be performed so as to keep the V net clocks of
different domains within an allowable range. Otherwise, it is recommended to apply IRIG-B
time synchronization for this circumstance.
SEE
ALSO For more information about notices on determining DLYT value, see the following:
Precaution for Engineering of 2.8, Inter-SCS Safety Communication of the Engineering Guide (IM
32S01C10-21E)
n Remarks
question match between the producing side and consuming side.


The input/output parameters of the CONS_B function block operate in the same way as in the
actual SCS.
However, the diagnoses for reception interval timeout and transmission delay timeout will be
skipped. Therefore, CONS_B function block will not indicate an error even when the source SCS
simulator stops for a while.

Table Arguments of CONS_B at Logic Simulation Test
BVAR Invalid
VAL Valid Valiable of VAL is output to OUT.
IN
OUTT Invalid Invalid
DLYT Invalid Invalid
OUT TRUE/FALSE
OUT The fail-safe value is always output to OUT.
NR FALSE Always FALSE

<C4.5 CONS_I (Inter-SCS Safety Communication INTEGER-Type Data Consumer)> C4-13
C4.5 CONS_I (Inter-SCS Safety Communication

INTEGER-Type Data Consumer)
A CONS_I function block receives DINT-type data sent from a PROD_I function block of
another SCS and, if there is no error, outputs the data.
CONS_I
BVAR OUT
VAL
OUTT
DLYT NR
C040501E.ai
Figure CONS_I
n Arguments
Table Arguments of CONS_I
BVAR COM_DINT Binding variable for receiving DINT-type data
VAL DINT Fail-safe value output at error occurrence
IN Generates a communication error if OUTT becomes smaller
than the reception interval.
Generates a communication error if DLYT becomes smaller than
DLYT TIME
transmission delay.
OUT DINT Output value
FALSE: Abnormal (including non-received data)

n Description
This function block receives DINT-type data sent from a PROD_I function block of a sending SCS
and outputs it via OUT. The communication status is output via NR.
If a communication error occurs, the CONS_I function block generates a diagnostic information
OUT

side side
TRUE
NR
FALSE

Communication Occurrence Recovery from
start of communi- communication
cation error error
C040502E.ai

Value (DLYT)
SEE
ALSO For the reception interval timeout value (OUTT) and transmission delay timeout value (DLYT), see the following:
n Description in C4.4, CONS_B (Inter-SCS Safety Communication BOOL-Type Data Consumer)
n Remarks


The input/output parameters of the CONS_I function block operate in the same way as in the
actual SCS.
skipped. Therefore, CONS_I function block will not indicate an error even when the source SCS

Table Arguments of CONS_I at Logic Simulation Test
BVAR Invalid
IN
OUT TRUE/FALSE

<C4.6 CONS_R (Inter-SCS Safety Communication REAL-Type Data Consumer)> C4-16
C4.6 CONS_R (Inter-SCS Safety Communication

REAL-Type Data Consumer)
A CONS_R function block receives REAL-type data sent from a PROD_R function block of
another SCS and, if there is not error, outputs the data.
CONS_R
BVAR OUT
VAL
OUTT
DLYT NR
C040601E.ai
Figure CONS_R
n Arguments
Table Arguments of CONS_R
BVAR COM_REAL Binding variable for receiving REAL-type data
VAL REAL Fail-safe value output at error occurrence
IN Generates a communication error if OUTT becomes smaller
than the reception interval.
Generates a communication error if DLYT becomes smaller than
DLYT TIME
transmission delay.
OUT REAL Output value
FALSE: Abnormal (including non-received data)

n Description
This function block receives REAL-type data sent from a PROD_R function block of a sending
SCS and outputs it via OUT. The communication status is output via NR.
If a communication error occurs, the CONS_R function block generates a diagnostic information
OUT

side side
TRUE
NR
FALSE

Communication Occurrence Recovery from
start of communi- communication
cation error error
C040602E.ai

Value (DLYT)
SEE
ALSO For the reception interval timeout value (OUTT) and transmission delay timeout value (DLYT), see the following:
n Description in C4.4, CONS_B (Inter-SCS Safety Communication BOOL-Type Data Consumer)
n Remarks


The input/output parameters of the CONS_R function block operate in the same way as in the
actual SCS.
skipped. Therefore, CONS_R function block will not indicate an error even when the source SCS

Table Arguments of CONS_R at Logic Simulation Test
BVAR Invalid
IN
OUT TRUE/FALSE

<C4.7 LTSND (Link Transmission Data Output Block)> C4-19
C4.7 LTSND (Link Transmission Data Output)

An LTSND function block is used for sending data through SCS link transmission.
LTSND
C040701E.ai
Figure LTSND
n Arguments
Table Arguments of LTSND
IN V BOOL Input value
n Description
The BOOL type datum specified for input parameter V will be sent to other stations in the same
domain.
SEE
ALSO For more information about SYS_DIAG function block, see the following:
n Remarks
For other POU to use the set datum, the input signal needs to be diverged. And the diverged
signal should be connected to a global variable, and the global variable should be used.
later.

<C4.7 LTSND (Link Transmission Data Output Block)> C4-20

The input parameters of the LTSND function block operate in the same way as in the actual SCS.

The SCS link transmission is invalid. The input parameter is invalid.
Table Arguments of LTSND at Logic Simulation Test
IN V Invalid The input values are invalid.

<C4.8 LTRCV (Safety Link Transmission Data Input Block)> C4-21
C4.8 LTRCV (Safety Link Transmission Data

Input)
An LTRCV function block is used for receiving safety data from other SCSs through SCS
link transmission.
LTRCV
STS
C040801E.ai
Figure LTRCV
n Arguments
Table Arguments of LTRCV
V BOOL Output value
OUT Data status (SCS link transmission data receiving)
STS BOOL TRUE: Normal
FALSE: Abnormal (including cases where data is not received)
n Description
The output parameter V is to output the data sent from other SCSs in the same domain.
The output parameter STS is to output the reception status of SCS link transmission safety
communication.
When a communication error occurs, a value which specified in the [Input Processing at
Fault] item in Wiring Definition of SCS Link Transmission Builder will be output from V. When
communication error recovers, the output will recover to normal value.
Create application logics for latching and unlatching the output to manage the error occurrence.
n Remarks

<C4.8 LTRCV (Safety Link Transmission Data Input Block)> C4-22

The output parameters of the LTRCV function block operate in the same way as in the actual
SCS.

The SCS link transmission is invalid. The output parameters are invalid.
Table Arguments of LTRCV at Logic Simulation Test
V Invalid The output values are invalid.
OUT
STS Invalid The data status is invalid.

<C5.1 Override Function Blocks> C5-1
C5. Function Blocks for Integration with

CENTUM (Safety FBs)
In this chapter, the safety function blocks applied in the integrated system with CENTUM
will be explained.
The following function blocks are provided for integration with CENTUM.
Override Function Blocks
Grouping Override Function Blocks
PASSWD (PASSWD)
BOOL-Type Data Manual Operation Function Block with Two-Position Answerback
(MOB_11)
BOOL-Type Data Manual Operation Function Block with Three-Position Answerback
(MOB_21)
Auto-Reset BOOL-Type Data Manual Operation (MOB_RS)
Analog-Type Data Manual Operation (MOA)
C5.1 Override Function Blocks

Override function blocks (override FBs) override variables of an application logic. There
are the following five types according to the data type of the overridden variables.
OVR_B (BOOL-Type Data Override)
OVR_I (INTEGER-Type Data Override)
OVR_R (REAL-Type Data Override)
OVR_IB (IO_BOOL-Type Data Override)
OVR_IR (IO_REAL-Type Data Override)
SEE
ALSO For outline of the actions of the override function block, see the following:
D3.1, Overview of Override FB
For more information about the tag name interface and the process alarm of the override function block,
see the following:
D3.2, Tag Name Interfaces and Process Alarms of Override Function Blocks

n Override Function Blocks

An override operation from an HIS is performed by using an override function block. The usage
of the override function blocks are explained using the OVER_B function block, which overrides
BOOL-type variables, as an example. Three parameters, IN, VAL and OUT, have different data
types according to the override function block corresponding to the data type of the overridden
variables.
OVR_B
IN OUT
VAL STS
SW
C050101E.ai
Figure OVR_B
l Types of Override Function Blocks

There are five types of override function blocks, one for each data type, as shown in the table
below. Arguments other than input parameter IN, output parameter OUT and input parameter
VAL are common for all of the function blocks regardless of the data type.
Table Types of Override Function Blocks
Data type of
FB type Data type of VAL Remark
IN and OUT
OVR_B BOOL BOOL
OVR_I DINT DINT
OVR_R REAL REAL
OVR_IB IO_BOOL BOOL The data status of output parameter OUT
OVR_IR IO_REAL REAL during override is GOOD.
n Arguments
Table Arguments of OVR_B, OVR_I, OVR_R, OVR_IB, OVR_IR
IN (*1) Input
VAL (*1) Override value
IN
TRUE: Override allowed. Override releasable
SW BOOL
FALSE: Override not allowed. Override not releasable
OUT (*1) Output
OUT TRUE: Overridden and OUT outputs the value specified in VAL
STS BOOL
FALSE: Not overridden and OUT outputs data input to IN
*1: The data type varies with the FB models. See the table of Types of Override Function Blocks.

n Description
The override function blocks output the data input from input parameter IN as is via output
parameter OUT as long as no overriding operation is performed. If an override instruction is set
from an HIS, on the other hand, the override function blocks output the data specified in input
parameter VAL via output parameter OUT. In short, data is fixed to the value defined in input
parameter VAL in advance. If the override operation is canceled from the HIS, the override
function blocks resume outputting data input from input parameter IN via output parameter OUT.
n Remarks
SW is a parameter that permits overriding. However, an override instruction is not canceled
even if the SW input changes from TRUE to FALSE while the override operation is
performed from an HIS.
It is possible to control the status of the override function blocks with a SYS_OVR system
function block.
SEE
ALSO For the SYS_OVR system function block, see the following:
C9.9, SYS_OVR (Override Function Blocks Management)

The input/output parameters of the OVR_B, OVR_I, OVR_R, OVR_IB and OVR_IR function
block operate in the same way as in the actual SCS.

The CENTUM integration function is invalid. The override function blocks cannot be overridden.
Table Arguments of OVR_B, OVR_I, OVR_R, OVR_IB, OVR_IR at Logic Simulation Test
IN (*1) Variable of IN is always output by OUT
IN VAL Invalid Invalid, Cannot be overridden
SW Invalid Invalid
OUT (*1) Always output the variable of IN
OUT
STS FALSE Always FALSE
*1: The data type varies with the FB models. See the table of Types of Override Function Blocks.
SEE
ALSO For more information regarding the table of Types of override Function Blocks, see the following:
Types of Override Function Blocks in Override Function Blocks

<C5.2 Grouping Override Function Blocks> C5-4
C5.2 Grouping Override Function Blocks

The grouping override function block can be used for management of the override blocks
per groups. To cope with different types of variables, there are following two types of
blocks.
GOV_B (BOOL-Type Data Grouping Override)
GOV_IB (IO_BOOL-Type Data Grouping Override)
SEE
ALSO For more information about overview of grouping override function block, see the following:
D3.3, Overview of Grouping Override Function Block
For more information about tag name interfaces and process alarms of grouping override function blocks,
see the following:
D3.4, Tag Name Interfaces and Process Alarms of Grouping Override Function Block
n Grouping Override Function Block

When using the grouping override function block, the override operation for the multiple data
defined in a group can be restricted for only one operation at a time.
The usage of the grouping override function blocks are explained using the GOV_B function
block, which overrides BOOL-type variables, as an example. Two parameters, IN and OUT, have
different data types according to the grouping override function block corresponding to the data
type of the overridden variables.
GOV_B
IN OUT
GRP STS
VAL ENS
SW
C050201E.ai
Figure GOV_B
l Types of Grouping Override Function Blocks

There are two types of grouping override function blocks, one for each data type, as shown in the
table below. Arguments other than input parameter IN and output parameter OUT are common
for all of the function blocks regardless of the data type.
Table Types of Grouping Override Function Blocks
Data type of
FB type Data type of VAL Remark
IN and OUT
GOV_B BOOL BOOL
The data status of output parameter
GOV_IB IO_BOOL BOOL
OUT during override is GOOD.

n Arguments
Table Arguments of GOV_B, GOV_IB
IN (*1) Input
Group number: 0 to 128
GRP DINT Enter a fixed value as the group number.
Enter a 0 to disable grouping.
IN
VAL BOOL Override value
Override permit switch
SW BOOL TRUE: Override permission
FALSE: Override prohibition
OUT (*1) Output
TRUE: Overridden and OUT outputs the value specified in VAL
STS BOOL
FALSE: Not overridden and OUT outputs data input to IN
OUT TRUE: Override executable.
If GRP is 0 and SW is TRUE, ENS will be TRUE.
ENS BOOL When overridden, ENS will be TRUE.
FALSE: Override disabled.
If GRP is less than 0 or greater than 128, ENS will be FALSE.
*1: The data type varies with the FB models. See the table of Types of Grouping Override Function Blocks.
n Description
The grouping override function blocks output the data input from input parameter IN as is via
output parameter OUT as long as no overriding operation is performed.
If the SW of the input parameter is TRUE and no other function block within the group is
running override, the output parameter ENS will be TRUE.
If an override operation is performed from an HIS, the grouping override function block
output the data specified in input parameter VAL via output parameter OUT.
This means to fix the datum using the value previously defined to the input parameter
VAL. In this case, the ENS of other override function blocks in the same group will become
FALSE.
If the override operation is canceled from the HIS, the grouping override function block
resume outputting data input from parameter IN via parameter OUT.
In this case, the ENS of the override function blocks in the same group will become TRUE
as long as the FBs SW is TRUE.
When override is being executed, the status of the output parameter OUT (IO_BOOL type)
of GOV_IB will be GOOD. When override is not being executed, the data status of input
parameter IN will be output as the data status of OUT.

n Remarks
The multiple override function blocks in the same group can not be executed override at the
same time.
The group number (GRP) should be specified with a constant of 0 to 128.
The function block with a group number of 0 can perform multiple override actions.
For a function block that is running override, if the SW parameter changes from TRUE to
FALSE, the override status will be released, and ENS parameter will become FALSE.
For GOV_IB during the override execution, if the SW parameter changes from TRUE to
FALSE, or if SYS_OVR issues a forced cancellation command, the override status will be
canceled even if IN data status is BAD.
It is possible to manage the status of the grouping override function blocks with a SYS_OVR
system function block.
These function blocks can be used in new SCS databases created in the software version
of R1.03.00 or later.

The input/output parameters of the GOV_B and GOV_IB function block operate in the same way
as in the actual SCS.

The CENTUM integration function is invalid. The grouping override function blocks cannot be
overridden.
Table Arguments of GOV_B, GOV_IB at Logic Simulation Test
IN IN (*1) Data of IN is always output by OUT
GRP Invalid The group number is invalid.
VAL Invalid The override setting value is invalid.
SW Invalid The override enable switch is invalid.
OUT OUT (*1) Always output the data of IN
STS FALSE Always FALSE
ENS FALSE Always FALSE
*1: The data type varies with the FB models. See the table of Types of Grouping Override Function Blocks.
SEE
ALSO For more information regarding the table of Types of Grouping Override Function Blocks, see the following:
Types of Grouping Override Function Blocks in Grouping Override Function Blocks

<C5.3 PASSWD (Password)> C5-7
C5.3 PASSWD (Password)

The PASSWD function block sets the output value to either TRUE or FALSE upon
examination of the password character string sent from an HIS.
PASSWD
PSWD OUT
C050301E.ai
Figure PASSWD
n Arguments
Table Arguments of PASSWD
Character
IN PSWD Password character string (up to 16 single-byte characters)
Constant
TRUE: TRUE is set via a mapping block
OUT OUT BOOL
FALSE: FALSE is set via a mapping block
n Description
A password character string entered on the faceplate of an HIS is transmitted to the PASSWD
function block via a mapping block. If this character string matches with the character string
specified for input parameter PSWD, a data value set to either TRUE or FALSE is received. As a
result, the PASSWD function block outputs the same value (TRUE or FALSE) as the data set via
the mapping block, to its output parameter OUT.
The default value of output parameter OUT of the PASSWD function block is FALSE. Make sure
to configure the PASSWD function block such that it outputs FALSE under normal circumstances
and TRUE when data requiring password authentication is set from an HIS when performing
processing (e.g., allow override operation).
SEE
ALSO For more information about how to use the PASSWD function block in override operation from an HIS, see
the following:
D3.6, Permission for Override by Password FB
For more information about tag name interface and process alarm of PASSWD FB, see the following:
D3.7, Tag Name Interfaces and Process Alarms of Password Function Blocks

<C5.3 PASSWD (Password)> C5-8
n Remarks
Specify a password as a character string constant for the PSWD input parameter. A character
string of up to 16 alphanumeric characters can be specified for the PSWD input parameter. If a
character string exceeding 16 characters is specified for the PSWD input parameter, only the first
16 characters become the target of comparison and other characters are ignored.
It is recommended to specify a different password character string for each PASSWD function
block and make each password unique within the system.
It is possible to manage the status of the PASSWD function block with a SYS_PSWD
It is possible to forcibly return the output of all PASSWD function blocks within an SCS to
FALSE by the SYS_PSWD function block.
SEE
ALSO For the SYS_PSWD system function block, see the following:
C9.10, SYS_PSWD (Password Function Blocks Management)

The input/output parameters of the PASSWD function block operate in the same way as in the
actual SCS.

The CENTUM integration function is invalid. The PASSWD function block always output FALSE
from OUT, the password string becomes invalid.
n Handling Password Character Strings

When an engineer creates an application logic that utilizes the PASSWD function block, a
character string constant is written in the PSWD input parameter of the PASSWD function
block and used as the password; this means that the password character string can be read by
looking at the FBD. As a countermeasure to this, the security setting for POUs available in the
Workbench can be used.
If it is desired to hide a password, apply the security setting for each POU that uses a PASSWD
function block (POUs in which a password character string is written) in the Workbench. As
a result, the POUs cannot be opened, nor can the self-documentation be printed, unless the
password specified for the security setting for each POU is entered.

<C5.4 MOB_11 (BOOL-Type Data Manual Operation Function Block ... > C5-9
C5.4 MOB_11 (BOOL-Type Data Manual

Operation Function Block with Two-Position
Answerback)
For example, an MOB_11 function block is used to perform manual operations mainly
from an HIS, with checking of answerback from either one of the opening/closing limit
switches of a valve.
MOB_11
SHDN OUT
SS NANP
IN NANM
SW
AIN
MTM
IOP
OOP
OTEN
PSWD
C050401E.ai
Figure MOB_11

n Arguments
Table Arguments of MOB_11
Shutdown signal
SHDN BOOL
The meaning of the signal is determined by the value of SS.
SS BOOL TRUE: ETS
FALSE: DTS
Value specified to be output when manual operation is prohibited
IN BOOL The value specified in this parameter is output to OUT if SW is
FALSE.
Toggle switch permitting and prohibiting manual operation
SW BOOL TRUE: The operation output value from an HIS is output to OUT
FALSE: The value set in IN is output to OUT
Answerback input value (*1)
AIN BOOL TRUE: Open status
IN FALSE: Close status
Answerback check mask time (Must be an integer multiple of the
MTM TIME
scan period)
Signal for monitoring input status
IOP BOOL TRUE: Normal status
FALSE: Abnormal status
Signal for monitoring output status
OOP BOOL TRUE: Normal status
Signal indicating output enable status
OTEN BOOL TRUE: Output is enabled
FALSE: Output is disabled
Character
PSWD Password character string (up to 16 single-byte characters)
constant
Open/close operation output value (*1)
OUT BOOL TRUE: Open instruction
FALSE: Close instruction
Answerback status on the open side (*1)
OUT NANP BOOL TRUE: Normal status
Answerback status on the close side (*1)
NANM BOOL TRUE: Normal status
*1: With the assumption that the manipulated target is a valve, Open and Close are used in the description of the argument.

n Description
An MOB_11 function block is used to perform manual operations from an HIS at starting up and
maintaining a plant. It outputs BOOL type values.
The MOB_11 function has input parameters (SHDN and SS) for receiving shutdown events and
outputs shutdown logic signals with the highest priority if a shutdown event occurs.
It is possible to switch between permitting and prohibiting manual operations from an HIS by
the input to SW. If TRUE is input to SW, the MOB_11 function block outputs a manual operation
output value from the HIS to OUT. If FALSE is input to SW, it outputs the IN value as is to OUT.
It also performs answerback checks based on the answerback input value (AIN) and OUT and
outputs the results to NANP and NANM.
MOB_11 has the following functions.
Shutdown signals output
Manual operation permission
Manual operation authenticated by password
Output enable status display
Answerback check
IOP/OOP monitoring
CENTUM integration
SEE
ALSO For more information about MOB_11, see the following:
D4.1, HIS Interfaces of MOB_11 and MOB_21 (BOOL-Type Data Manual Operation Function Block with
Answerback)
n Shutdown Output Operation
l Overview of Shutdown Output

SHDN and SS match: The value specified for SS is output from OUT.
SHDN does not match SS: Either the IN value or the manual operation value from an HIS,
depending on the status of manual operation permission (SW), is output from OUT.
l Details of Shutdown Output

Enter signals for shutdown processing in SHDN and SS. If the value input to SHDN matches
the safe state specified with SS, an MOB_11 function block processes it as an occurrence of a
shutdown event and performs the shutdown processing, outputting the SS value to OUT with the
highest priority.
Define for SS whether the signal input to SHDN is handled as DTS or ETS.
To apply the signal to the DTS (De-energized To Safe) logic: Input FALSE to SS.
To apply the signal to the ETS (Energized To Safe) logic: Input TRUE to SS.
If SHDN does not match the safe state specified with SS, either the value input to IN or the
manual operation value from the HIS is output from OUT.

n Remarks

The answerback check masking time (MTM) on SCS simulator and on actual SCS may take
different time to reach time-up.

The input/output parameters of the MOB_11 function block operate in the same way as in the
actual SCS.
The following functions become invalid, however.
System alarm notification
Data reference using tag names from CENTUM and process alarm notification
Table Arguments of MOB_11 at Logic Simulation Test

SHDN Valid
SS Valid
IN Valid
SW Valid If TRUE is input to SW, the output value is retained for OUT.
IN AIN Valid
MTM Valid
IOP Invalid The value has no influence on operation and is ignored.
OOP Invalid The value has no influence on operation and is ignored.
PSWD Invalid Password entry is not performed.
The following values are output.
OUT TRUE/FALSE SW is TRUE: Retain output value
SW is FALSE: Output IN value
OUT
NANP TRUE/FALSE Answerback status on the open side is output.
NANM TRUE/FALSE Answerback status on the close side is output.

<C5.5 MOB_21 (BOOL-Type Data Manual Operation Function Block with ... > C5-13
C5.5 MOB_21 (BOOL-Type Data Manual

Operation Function Block with Three-
Position Answerback)
For example, an MOB_21 function block is used to perform manual operations mainly
from an HIS, with checking of answerback inputs from each of the opening/closing limit
switches of a valve.
MOB_21
SHDN OUT
SS NANP
IN NANM
SW NPER
AINP
AINM
MTM
IOP
OOP
OTEN
PSWD
C050501E.ai
Figure MOB_21

n Arguments
Table Arguments of MOB_21
Shutdown signal
SHDN BOOL
(The meaning of the signal is determined by the value of SS.)
SS BOOL TRUE: ETS
FALSE: DTS
Value specified to be output when manual operation is prohibited
IN BOOL The value specified in this parameter is output to OUT if SW is
FALSE.
Toggle switch between permitting and prohibiting manual operation
SW BOOL TRUE: The operation output value from HIS is output to OUT.
FALSE: The value set in IN is output to OUT.
Answerback input value on the open side (*1)
AINP BOOL TRUE: Full-open status
FALSE: Not full-open status
Answerback input value on the close side (*1)
IN
AINM BOOL TRUE: Full-close status
FALSE: Not full-close status
Answerback check mask time
MTM TIME
(Must be an integer multiple of the scan period)
Signal for monitoring input status
IOP BOOL TRUE: Normal status
Character
constant
Open/close operation output value (*1)
OUT BOOL TRUE: Open instruction
Answerback status on the open side (*1)
NANP BOOL TRUE: Normal status
OUT
Answerback status on the close side (*1)
Answerback pattern
NPER BOOL TRUE: Normal status
*1: With the assumption that the manipulated target is a valve, Open and Close are used in the description of the argument.

n Description
An MOB_21 function block is used to perform manual operations from an HIS at starting up and
maintaining a plant. It outputs BOOL type values.
The MOB_21 function block has input parameters (SHDN and SS) for receiving shutdown events
and outputs shutdown logic signals with the highest priority if a shutdown event occurs.
the input to SW. If TRUE is input to SW, the MOB_21 function block outputs a manual operation
output value from the HIS to OUT. If FALSE is input to SW, it outputs the IN value as is to OUT.
It also performs answerback checks based on OUT and the answerback input values (AINP and
AINM) for opening and closing, respectively, and outputs the results to NANP, NANM and NPER.
MOB_21 has the following functions.
Answerback check
IOP/OOP monitoring
CENTUM integration
SEE
ALSO The shutdown signals output function is the same as for MOB_11; see the following:
n Shutdown Output Operation in C5.4, MOB_11 (BOOL-Type Data Manual Operation Function Block
with Two-Position Answerback)
For the detailed explanations of other functions, see the following:
Answerback)
n Remarks



The input/output parameters of the MOB_21 function block operate in the same way as in the
actual SCS.
Table Arguments of MOB_21 at Logic Simulation Test

SHDN Valid
SS Valid
IN Valid
AINP Valid
IN
AINM Valid
MTM Valid
IOP Invalid The value has no influence on operation and is ignored.
OUT TRUE/FALSE SW is TRUE: Retain output value
OUT NANP TRUE/FALSE Answerback status on the open side is output.
NANM TRUE/FALSE Answerback status on the close side is output.
NPER TRUE/FALSE Answerback pattern status is output.

<C5.6 MOB_RS (Auto-Reset BOOL-Type Data Manual Operation)> C5-17
C5.6 MOB_RS (Auto-Reset BOOL-Type Data

Manual Operation)
An MOB_RS function block outputs one-shot signals when manual operations are
performed from an HIS.
MOB_RS
SW OUT
AIN NANM
ADIR
MTM
C050601E.ai
Figure MOB_RS
n Arguments
Table Arguments of MOB_RS
FALSE: FALSE is output to OUT.
AIN BOOL Answerback input value
IN Answerback operation direction specification
ADIR BOOL TRUE: Forward operation
FALSE: Reverse operation
Answerback check mask time
MTM TIME
OUT BOOL Operation output value for logic reset (pulse signal)
OUT Answerback status

n Description
An MOB_RS function block outputs signals according to manual operations from an HIS and has
the function to automatically recover the output value after one SCS scan period. It can be used
as a switch to reset shutdown status at restoration of a plant if the plant is shut down by shutdown
logic signals.
the input to SW. If TRUE is input to SW, manual operations from the HIS are allowed. If MV is
changed from 0 to 2 via manual operations from the HIS, the MOB_RS function block outputs
TRUE to OUT. The value of OUT is automatically reset to FALSE after one scan.
If FALSE is input to SW, manual operations from the HIS are prohibited and the MOB_RS
function block outputs FALSE to OUT.
MOB_RS has the following functions.

Automatic reset
Answerback check
CENTUM integration
SEE
ALSO For manual operation permission and automatic reset functions, see the following:
n Overview of Processing MOB_RS in D4.2.1, Operations of MOB_RS from HIS
For the answerback check function, see the following:
n Answerback Check in D4.2.1, Operations of MOB_RS from HIS
For the CENTUM integration function, see the following:
D4.2.2, Tag Name Interfaces and Process Alarms of MOB_RS
n Remarks



The input/output parameters of the MOB_RS function block operate in the same way as in the
actual SCS.
Table Arguments of MOB_RS at Logic Simulation Test

FALSE (fixed) is output to OUT regardless of whether SW is
SW Valid
TRUE or FALSE
IN AIN Valid
ADIR Valid
MTM Valid
FALSE (fixed) is output to OUT regardless of whether SW is
OUT FALSE
OUT TRUE or FALSE
NANM TRUE/FALSE Answerback status is output

<C5.7 MOA (Analog-Type Data Manual Operation)> C5-20
C5.7 MOA (Analog-Type Data Manual Operation)

Using an MOA function block, it is possible to monitor/change values of analog output
variables from an HIS.
MOA
SHDN OUT
SDV
IN
SW
FV
OOP
OTEN
PSWD
C050701E.ai
Figure MOA
n Arguments
Table Arguments of MOA
Shutdown signal
SHDN BOOL TRUE: Normal processing is performed
FALSE: Shutdown processing is performed
SDV REAL Shutdown output value (0 to 100%)
Value specified to be output when manual operation is prohibited (0 to
IN REAL 100%)
The value specified in this parameter is output to OUT if SW is FALSE.
IN FALSE: The value set in IN is output to OUT.
FV REAL Feedback input value
Character
constant
OUT OUT REAL Analog operation output value (0 to 100%)

n Description
Using an MOA function block, it is possible to monitor/change values of analog output variables
from an HIS.
The MOA function block has input parameters (SHDN and SDV) for receiving shutdown events
and outputs shutdown logic signals with the highest priority if a shutdown event occurs.
It is possible to switch between permitting and prohibiting manual operations from an HIS by the
input to SW. If TRUE is input to SW, the MOA function block outputs a manual operation output
value from the HIS to OUT. If FALSE is input to SW, it outputs the IN value as is to OUT.
Note that MOA outputs the actual value as is to OUT even if the shutdown output value (SDV) or
IN value are outside the range from 0 to 100%.
MOA has the following functions.
Feedback
OOP monitoring
CENTUM integration
SEE
ALSO For the shutdown output and manual operation permission functions, see the following:
n Overview of Processing MOA in D4.3.1, Operations of MOA from HIS
For the feedback function, see the following:
n Feedback Input in D4.3.1, Operations of MOA from HIS
For the OOP function, see the following:
n OOP Detection in D4.3.1, Operations of MOA from HIS
The output enable status display function is common with MOB_11 and MOB_21; see the following:
D4.1.3, Output Enable Status Display Function
The password function is common with MOB_11 and MOB_21; see the following:
D4.1.2, Password at Manual Operations
For more information about the CENTUM integration function, see the following:
D4.3.2, Tag Name Interfaces and Process Alarms of MOA
n Remarks


The input/output parameters of the MOA function block operate in the same way as in the actual
SCS.

The input/output parameters of the MOA function block operate in the same way as in the actual
SCS.
Table Arguments of MOA at Logic Simulation Test

SHDN Valid
SDV Valid
IN Valid
IN
FV Invalid The value has no influence on operation and is ignored.
OTEN Invalid The value has no influence on operation and is ignored.
OUT OUT TRUE/FALSE SW is TRUE: Retain output value

<C6.1 ANN (Annunciator)> C6-1
C6. Interference-free Function Blocks

This chapter explains function blocks that are unique to ProSafe-RS and interference-free
(do not interfere with the safety functions).
The following function blocks are provided for interference-free.
Annunciator (ANN)
BOOL-Type Data SOER (SOE_B)
INTEGER-Type Data SOER (SOE_I)
REAL-Type Data SOER (SOE_R)
Interference-free Link Transmission Data Input (LTFCS)
C6.1 ANN (Annunciator)

An ANN function block generates annunciator messages if an HIS is connected.
ANN
IN
C060101E.ai
Figure ANN
n Arguments
Table Arguments of ANN
IN IN BOOL Input value
n Description
The ANN function block generates annunciator messages when an HIS is connected.
It generates an annunciator message notifying that an alarm has been generated if the input
value (IN) changes from FALSE to TRUE. If the input value (IN) changes from TRUE to FALSE,
it generates an annunciator message notifying that the function block has recovered from the
alarm. Message character strings are specified in Tag Name Builder. The default value for IN
when starting an SCS is FALSE.
SEE
ALSO For more information about the annunciator message definition in Tag Builder, see the following:
2.1.4, Definition of Tag Names in the Integration with CENTUM VP/CS 3000 (IM 32S01E10-21E)

<C6.1 ANN (Annunciator)> C6-2
n Remarks
The ANN function block is an interference-free function block.

The input parameter of the ANN function block operate in the same way as in the actual SCS.

The CENTUM integration function becomes invalid. Notification of annunciator messages is not
performed.

<C6.2 SOE_B (BOOL-Type Data SOER)> C6-3
C6.2 SOE_B (BOOL-Type Data SOER)

An SOE_B function block collects SOE data of BOOL type.
SOE_B
IN
TRP
ID
C060201E.ai
Figure SOE_B
n Arguments
Table Arguments of SOE_B
IN BOOL Input value
Trip signal specification
TRIP_NONE: Do not regard as a trip signal
TRP DINT
IN TRIP_OFF: Regard as a trip signal if IN changes from TRUE to FALSE
TRIP_ON: Regard as a trip signal if IN changes from FALSE to TRUE
Event identification character string constant (constant of up to 32
ID STRING
single-byte or 16 double-byte characters)
n Description
The SOE_B function block collects SOE data of BOOL type.
The SOE_B function block collects events at the timing when input value IN changes. If the trip
signal specification is set to a value other than TRIP_NONE, events collected with the SOE_B
function block are treated as trip signals. ID is event identification information and displayed in
SOE Viewer. Specify a character string (up to 32 single-byte or 16 double-byte characters) in
order to identify the event.
SEE
ALSO For the trip signals, see the following:
n Trip Signal in A7.3, Event Storage
n Remarks
The SOE_B function block is an interference-free function block. Specify a character string
constant for ID.
TRIP_NONE, TRIP_OFF and TRIP_ON have been defined in an SCS project in advance as
constants with the values 0, 1 and 2, respectively. Do not change predefined constants.

<C6.2 SOE_B (BOOL-Type Data SOER)> C6-4

The input parameters of the SOE_B function block operate in the same way as in the actual SCS.

The SOER function becomes invalid. Events are not recorded.

<C6.3 SOE_I (INTEGER-Type Data SOER)> C6-5
C6.3 SOE_I (INTEGER-Type Data SOER)

An SOE_I function block collects SOE data of integer type.
SOE_I
IN
TRIG
TRP
ID
C060301E.ai
Figure SOE_I
n Arguments
Table Arguments of SOE_I
IN DINT Input value
TRIG BOOL Trigger signal
IN TRIP_NONE: Do not regard as a trip signal
TRP DINT
TRIP_OFF: Triggers a trip signal when TRIG changes from TRUE to FALSE.
TRIP_ON: Triggers a trip signal when TRIG changes from FALSE to TRUE
Event identification character string constant (constant of up to 32 single-byte
ID STRING
or 16 double-byte characters)
n Description
The SOE_I function block collects SOE data of integer type.
The SOE_I function block collects events at the timing when the trigger signal value changes.
If the trip signal specification is set to TRIP_ON or TRIP_OFF, events collected with the SOE_I
function block are treated as trip signals. ID is event identification information and displayed on
SEE
n Remarks
The SOE_I function block is an interference-free function block. Specify a character string
constant for ID.
constants. Do not change already defined constants.

<C6.3 SOE_I (INTEGER-Type Data SOER)> C6-6

The input parameters of the SOE_I function block operate in the same way as in the actual SCS.

The SOER function becomes invalid. Events are not recorded.

<C6.4 SOE_R (REAL-Type Data SOER)> C6-7
C6.4 SOE_R (REAL-Type Data SOER)

An SOE_R function block collects SOE data of real number type.
SOE_R
IN
TRIG
TRP
ID
C060401E.ai
Figure SOE_R
n Arguments
Table Arguments of SOE_R
IN REAL Input value
TRIG BOOL Trigger signal
IN TRIP_NONE: Do not regard as a trip signal
TRP DINT
TRIP_OFF: Triggers a trip signal when TRIG changes from TRUE to FALSE.
TRIP_ON: Triggers a trip signal when TRIG changes from FALSE to TRUE.
Event identification character string constant (constant of up to 32 single-byte
ID STRING
or 16 double-byte characters)
n Description
The SOE_R function block collects SOE data of real number type.
The SOE_R function block collects events at the timing when the trigger signal value changes.
If the trip signal specification is set to TRIP_ON or TRIP_OFF, events collected with the SOE_R
function block are treated as trip signals. ID is event identification information and displayed on
SEE
n Remarks
The SOE_R function block is an interference-free function block. Specify a character string
constant for ID.
constants. Do not change already defined constants.

<C6.4 SOE_R (REAL-Type Data SOER)> C6-8

The input parameters of the SOE_R function block operate in the same way as in the actual
SCS.

The SOE function becomes invalid. Events are not recorded.

<C6.5 LTFCS (Interference-free Link Transmission Data Input)> C6-9
C6.5 LTFCS (Interference-free Link Transmission

Data Input)
An LTFCS function block can be used for receiving the link transmission data (Global
Switch) sent from FCSs (including APCS and GSGW).
LTFCS
GSV
STS
C060501E.ai
Figure LTFCS
n Arguments
Table Arguments of LTFCS
GSV BOOL Output value (value of %GS)
OUT Data status
STS BOOL TRUE: Normal
FALSE: Abnormal (including cases where data is not received)
n Description
LTFCS is a function block for receiving the link transmission data (Global Switches) sent from
FCSs (including APCS and GSGW) in the same domain.
The output parameter GSV outputs the BOOL type data of the received global switches.
The output parameter STS outputs the data status of the received link transmission data.
When a communication error occurs, GSV will output a fail-safe value previously specified on the
SCS Link Transmission Builder.
When the communication recovers from the erroneous status, the block will return to output the
receiving data. Create application logics for latching and unlatching the output to manage the
error occurrence.
n Remarks
The LTFCS function block is an interference-free function block.
later.

<C6.5 LTFCS (Interference-free Link Transmission Data Input)> C6-10

The output parameters of the LTFCS function block operate in the same way as in the actual
SCS.

The SCS link transmission is invalid. The output parameters are invalid.
Table Arguments of LTFCS at Logic Simulation Test
GSV Invalid The output values are invalid.
OUT
STS Invalid The data status of the global switch is invalid.

<C7.1 SCI_B (BOOL-Type Subsystem Communication Input)> C7-1
C7. Subsystem Communication

Function Blocks
In this chapter, the function blocks used for subsystem communication will be explained.
The following function blocks are provided for subsystem communication.
BOOL-Type Subsystem Communication Input (SCI_B)
INTEGER-Type Subsystem Communication Input (SCI_I)
REAL-Type Subsystem Communication Input (SCI_R)
BOOL-Type Subsystem Communication Output (SCO_B)
INTEGER-Type Subsystem Communication Output (SCO_I)
REAL-Type Subsystem Communication Output (SCO_R)
C7.1 SCI_B (BOOL-Type Subsystem

Communication Input)
An SCI_B function block is used to input to the application logic the communication input
data and data status that have been wired to SCI_B instances using the Communication
I/O Builder.
SCI_B
V
STS
C070101E.ai
Figure SCI_B
n Arguments
Table Arguments of SCI_B
V BOOL Data value
OUT Data status

STS BOOL TRUE: GOOD (Communication data reception was successful)
FALSE: BAD (Communication data reception failed)
n Description
The SCI_B function block inputs the BOOL-type communication data and data status received
from subsystems to the application logic.
The data value (V) is a value input from a subsystem.
The data status (STS) indicates whether or not the data was acquired from the applicable
subsystem (*1). It becomes TRUE if the data was acquired, and FALSE if it could not be
acquired.
*1: Errors in subsystems, such as an error of a subsystems input terminal or wiring error between a subsystems input terminal and
a sensor, cannot be detected. These errors need to be handled in the applicable subsystem.

<C7.1 SCI_B (BOOL-Type Subsystem Communication Input)> C7-2
n Remarks
The SCI_B function block is an interference-free function block. Do not use it to input data to
safety loops.
The SCI_B is a function block that assumes use of communication inputs. Create instances
and wire them to communication inputs using the Communication I/O Builder.
later.

Same as an actual SCS, the SCS simulator can read the logical data in the communication I/O
data area. Since the physical modules do not exist, the data values and data status are different
from the actual SCS.
SEE
ALSO For more information about operation in SCS simulation test, see the following:
3.3, Execution of SCS Simulation Tests of the ProSafe-RS System Test Reference (IM 32S04B30-21E)

The table below lists the output values in a logic simulation test.
Table Arguments of SCI_B in Logic Simulation Test
The previous value is retained. (Default: FALSE)
Retention of
V The SCI_B function block can be used to debug the application
previous value
logic by changing this value.
OUT
Retention of
STS The SCI_B function block can be used to debug the application
previous value

<C7.2 SCI_I (INTEGER-Type Subsystem Communication Input)> C7-3
C7.2 SCI_I (INTEGER-Type Subsystem

An SCI_I function block is used to input to the application logic the communication input
data and data status that have been wired to SCI_I instances using the Communication I/O
Builder.
SCI_I
V
STS
C070201E.ai
Figure SCI_I
n Arguments
Table Arguments of SCI_I
V DINT Data value
OUT Data status
n Description
The SCI_I function block inputs the integer-type communication data and data status received
from subsystems to the application logic.
acquired.
n Remarks
The SCI_I function block is an interference-free function block. Do not use it to input data to
safety loops.
The SCI_I is a function block that assumes use of communication inputs. Create instances
later.

<C7.2 SCI_I (INTEGER-Type Subsystem Communication Input)> C7-4

SEE

Table Arguments of SCI_I in Logic Simulation Test
The previous value is retained. (Default: 0)
Retention of
V The SCI_I function block can be used to debug the application
previous value
OUT
Retention of
STS The SCI_I function block can be used to debug the application
previous value

<C7.3 SCI_R (REAL-Type Subsystem Communication Input)> C7-5
C7.3 SCI_R (REAL-Type Subsystem

An SCI_R function block is used to input to the application logic the communication input
data and data status that have been wired to SCI_R instances using the Communication
I/O Builder.
SCI_R
V
STS
C070301E.ai
Figure SCI_R
n Arguments
Table Arguments of SCI_R
V REAL Data value
OUT Data status
n Description
The SCI_R function block inputs the real number-type communication data and data status
received from subsystems to the application logic.
acquired.
n Remarks
The SCI_R function block is an interference-free function block. Do not use it to input data to
safety loops.
The SCI_R is a function block that assumes use of communication inputs. Create instances
later.

<C7.3 SCI_R (REAL-Type Subsystem Communication Input)> C7-6

SEE

Table Arguments of SCI_R in Logic Simulation Test
The previous value is retained. (Default: 0.0)
Retention of
V The SCI_R function block can be used to debug the application
previous value
OUT
Retention of
STS The SCI_R function block can be used to debug the application
previous value

<C7.4 SCO_B (BOOL-Type Subsystem Communication Output)> C7-7
C7.4 SCO_B (BOOL-Type Subsystem

Communication Output)
An SCO_B function block is used to output values of the application logic to
the communication outputs that have been wired to SCO_B instances using the
Communication I/O Builder.
SCO_B
V RDBK
STS
C070401E.ai
Figure SCO_B
n Arguments
Table Arguments of SCO_B
IN V BOOL Data value
RDBK BOOL Reserved: Always FALSE
OUT Data status
STS BOOL TRUE: Communication with the subsystem was successful.
FALSE: Communication with the subsystem failed.
n Description
The SCO_B function block is used to output BOOL-type values of the application logic to
subsystems.
The data value (V) is a value output to a subsystem.
The data status (STS) indicates whether or not communication with the applicable
subsystem was successful (*1) (*2). It becomes TRUE if communication was successful,
and FALSE if communication failed.
*1: Errors in subsystems, such as an error of a subsystems output terminal or wiring error between a subsystems output terminal
and a device, cannot be detected. These errors need to be handled in the applicable subsystem.
*2: The data status becomes TRUE as long as communication was successful, even when the output enable operation is not yet
performed.
n Remarks
The SCO_B function block is an interference-free function block. Do not use it to input or
output data to/from safety loops.
The SCO_B is a function block that assumes use of communication outputs. Create
instances and wire them to communication outputs using the Communication I/O Builder.
later.

<C7.4 SCO_B (BOOL-Type Subsystem Communication Output)> C7-8

Same as an actual SCS, the SCS simulator can write the logical data to the communication I/O
data area. Since the physical modules do not exist, the communication cannot be established.

The table below lists the input/output values in a logic simulation test.
Table Arguments of SCO_B in Logic Simulation Test
Retention of
RDBK The previous value is retained. (Default: FALSE)
previous value
OUT The previous value is retained. (Default: FALSE)
Retention of
STS The SCO_B function block can be used to debug the application
previous value

<C7.5 SCO_I (INTEGER-Type Subsystem Communication Output)> C7-9
C7.5 SCO_I (INTEGER-Type Subsystem

An SCO_I function block is used to output values of the application logic to
the communication outputs that have been wired to SCO_I instances using the
SCO_I
V RDBK
STS
C070501E.ai
Figure SCO_I
n Arguments
Table Arguments of SCO_I
IN V DINT Data value
RDBK DINT Reserved: Always 0
OUT Data status
n Description
The SCO_I function block is used to output integer-type values of the application logic to
subsystems.
performed.

<C7.5 SCO_I (INTEGER-Type Subsystem Communication Output)> C7-10
n Remarks
The SCO_I function block is an interference-free function block. Do not use it to input or
The SCO_I is a function block that assumes use of communication outputs. Create
When SCO_I is applied for outputting a 16-bit integer (singed 16-bit integer or unsigned
16-bit integer) as communication datum of an analog output, if the value set to the SCO_I
is beyond the range of the 16-bit integer, the value will not be written to the communication
output image area (for outputting to subsystem) and the data status (STS) will become
FALSE.
Range of 16-bit integer (communication data of analog output):
Singed 16-bit integer: -32768 to 32767
Unsigned 16-bit integer: 0 to 65535
It is necessary to scheme the applications, such as checking the STS signal, prevent from
setting the value that exceeds the range of 16-bit integer to SCO_I.
later.

Same as an actual SCS, the SCS simulator can write the logical data to the communication I/O

Table Arguments of SCO_I in Logic Simulation Test
IN Invalid V The output values are invalid.
Retention of
RDBK The previous value is retained. (Default: 0)
previous value
Retention of
STS The SCO_I function block can be used to debug the application
previous value

<C7.6 SCO_R (REAL-Type Subsystem Communication Output)> C7-11
C7.6 SCO_R (REAL-Type Subsystem

An SCO_R function block is used to output values of the application logic to
the communication outputs that have been wired to SCO_R instances using the
SCO_R
V RDBK
STS
C070601E.ai
Figure SCO_R
n Arguments
Table Arguments of SCO_R
IN V REAL Data value
RDBK REAL Reserved: Always 0.0
OUT Data status
n Description
The SCO_R function block is used to output real number-type values of the application logic to
subsystems.
performed.
n Remarks
The SCO_R function block is an interference-free function block. Do not use it to input or
The SCO_R is a function block that assumes use of communication outputs. Create
later.

<C7.6 SCO_R (REAL-Type Subsystem Communication Output)> C7-12

Same as an actual SCS, the SCS Simulator can write the logical data to the communication I/O

Table Arguments of SCO_R in Logic Simulation Test
IN Invalid V The output values are invalid.
Retention of
RDBK The previous value is retained. (Default: 0.0)
previous value
Retention of
STS The SCO_R function block can be used to debug the application
previous value

<C8. External Communication Function Blocks> C8-1
C8. External Communication Function

Blocks
The external communication function blocks are applied for putting out the outside
(CENTUM or from the Modbus master via Modbus slave connection) setting values. There
are following three types of external communication function blocks.
Table Types of External Communication Function Blocks

Data type of output
Type Name Function
parameter OUT
ECW_B BOOL-Type Data External Communication BOOL-type data setting BOOL type
ECW_I INTEGER-Type Data External Communication DINT-type data setting DINT type
ECW_R REAL-Type Data External Communication REAL-type data setting REAL type
The following figures illustrate the three types of external communication function blocks.
ECW_B
OUT
BOOL-type data
ECW_I
OUT
DINT-type data
ECW_R
OUT
REAL-type data
C080001E.ai
Figure External Communication Function Blocks
SEE
ALSO For more information about how to use external communication function blocks, see the following:
D5, Data Setting Using External Communication Function Blocks
n Description
The external communication function blocks are used to set data from the Modbus master via
Modbus slave connection or to set data in a CENTUM integration structure.
n Remarks
The external communication function blocks are interference-free function blocks. To use data
set with ECW_B, ECW_I and ECW_R function blocks in the safety functions, it is necessary to
incorporate Safety Measure (various functions for securing safety) with a user application.

<C9. Safety System Function Blocks> C9-1
C9. Safety System Function Blocks

System function blocks reflect the status of an SCS. This chapter explains the safety
system function blocks.
The safety system function blocks are shown below.
SCS Status Management (SYS_STAT)
Forcing Status Management (SYS_FORCE)
SCS Link Transmission Lock Status Monitor (SYS_FORCE_LT)
SCS Link Transmission Reception Status Monitor (SYS_LTSTS)
Diagnostic information Output (SYS_DIAG)
Security Level Management (SYS_SECURE)
Security Level Protection (SYS_SEC_CTL)
Override Function Blocks Management (SYS_OVR)
Password Function Blocks Management (SYS_PSWD)
Station Output Shutdown (SYS_ALLSD)
Module Output Shutdown (SYS_IOSD)
All I/O Channels of SCS Status Indicator (SYS_IOALLST)
All I/O Channels of Node Status Indicator (SYS_NODEST)
Output Module 8 Channels Indicator (SYS_OUTST)
Output Module 16 Channels Indicator (SYS_OUTST16)
Input Module Status Indicator (SYS_INST)
Channel Status Indicator (SYS_CHST)
Output Module Status Indicator (SYS_OUTEN)

<C9.1 SYS_STAT (SCS Status Management)> C9-2
C9.1 SYS_STAT (SCS Status Management)

A SYS_STAT system function block indicates the operating status of an SCS.
SYS_STAT
RUN MODE
C090101E.ai
Figure SYS_STAT
n Arguments
Table Arguments of SYS_STAT
Output enable operation
IN RUN BOOL FALSE TRUE: Perform the output enable operation
Other: Nothing happens
Operating mode
OUT MODE DINT 3: Waiting mode
4: Running mode
n Description
The SYS_STAT system function block shows the operating status of an SCS.
The output enable operation on output modules is normally performed from an SENG, but it can
be performed from an application logic by using the SYS_STAT system function block. The SYS_
STAT system function block performs the output enable operation when RUN input changes from
FALSE to TRUE. Set RUN to FALSE if the output enable operation is not performed.
n Remarks
This function block does not affect the Output Enable status of subsystem communication. It only
affects safety outputs and outputs in inter-SCS safety communication immediately after an SCS
start.

The input/output parameters of the SYS_STAT function block operate in the same way as in the
actual SCS.

The table below shows the input and output values at a logic simulation test.
Table Arguments of the SYS_STAT System Function Block at Logic Simulation Tests
Do not perform the output enable operation regardless of the input
IN RUN Invalid
value.
OUT MODE 4 The operating mode is fixed to the Running mode.

<C9.2 SYS_FORCE (Forcing Status Management)> C9-3
C9.2 SYS_FORCE (Forcing Status Management)

A SYS_FORCE system function block controls the forcing status of variables within an
SCS.
SYS_FORCE
UNLK LOCK
CHKT NUM
FORC TUP
NOV
C090201E.ai
Figure SYS_FORCE
n Arguments
Table Arguments of SYS_FORCE
Forcibly cancel the forcing status of all variables
UNLK BOOL FALSE TRUE: Perform forced cancellation
IN Watching time of Forcing
CHKT TIME
0 may disable the watching timer
Maximum number of variables that can be forced at the same time
FORC DINT
FORC < 0 equivalent to FORC = 0
Existence of forced variables
LOCK BOOL FALSE: None
TRUE: At least one
NUM DINT Total number of forced variables
Indicates whether or not the locked status has continued exceeding the
OUT monitoring time
TUP BOOL
FALSE: The monitoring time is not exceeded
TRUE: The monitoring time is exceeded
Indicates whether or not the number of locked variables has exceeded
the maximum allowable number
NOV BOOL
FALSE: The maximum allowable number is not exceeded
TRUE: The maximum allowable number is exceeded

n Description
The SYS_FORCE system function block controls the forcing status.
l Input
UNLK is an input for forcibly cancelling the forced status of all variables. If UNLK changes
from FALSE to TRUE, all variables locked with the forcing function are forcibly unlocked. Set
UNLK to FALSE if this operation is not performed.
Specify the monitoring time of the forcing status for CHKT. If the status where one or
more variables are locked continues longer than the monitoring time specified by CHKT,
a diagnostic information message is generated to inform the user. Diagnostic information
messages are re-generated at intervals corresponding to the monitoring time specified by
CHKT.
Specify the maximum number of variables that can be locked at the same time for FORC.
If NUM becomes greater than FORC, a diagnostic information message is generated to
inform the user that the specified maximum number is exceeded. Note that if NUM becomes
equal to or smaller than FORC, a diagnostic information message notifying about the
recovery is generated.
l Output
LOCK is an output that indicates whether or not there are any variables that are locked.
LOCK becomes TRUE if any variable is locked.
NUM is the number of locked variables.
TUP is an output that indicates whether or not there are any variables that have remained
locked longer than the monitoring time specified by CHKT.
NOV is an output that indicates whether or not the number of locked variables has
exceeded the maximum allowable number specified by FORC.
n Remarks
The variables handled by this function block do not contain subsystem communication data.


The lock status monitoring time (CHKT) on SCS simulator and on actual SCS may take different
time to reach time-up.

All the inputs are invalid and all the outputs are fixed. Diagnostic information messages are not
generated either.
Table Arguments of the SYS_FORCE System Function Block at Logic Simulation Tests
Invalid. The forcing status is not forcibly cancelled regardless of the
UNLK Invalid
input value.
IN
CHKT Invalid Invalid
FORC Invalid Invalid
LOCK FALSE Indicates no forced variable.
NUM 0 Indicates no forced variable.
OUT
TUP FALSE Indicates no forced variable.
NOV FALSE Indicates no forced variable.

<C9.3 SYS_FORCE_LT (SCS Link Transmission Forcing Management)> C9-6
C9.3 SYS_FORCE_LT (SCS Link Transmission

Lock Status Monitor)
A SYS_FORCE_LT function block is used for forcing management of SCS link
transmission data.
SYS_FORCE_LT
UNLK LOCK
CHKT NUM
FORC TUP
NOV
C090301E.ai
Figure SYS_FORCE_LT
n Arguments
Table Arguments of SYS_FORCE_LT
Forcibly unlocks all the locked SCS Link Transmission data.
UNLK BOOL FALSE TRUE: Perform forced cancellation
Monitors the locked time of SCS link transmission data.
When the SCS link transmission data are locked for a time
CHKT TIME longer than CHKT time, a diagnostic information message will
IN be generated and sent to the user.
0 may disable this time monitoring.
Maximum number of stations that can be forced at the same time.
When the number of the stations locked SCS link transmission
FORC DINT data is greater than FORC, a diagnostic information message
will be generated and sent to the user. FORC < 0 equivalent to
FORC = 0
Existence of locked stations
TRUE: At least one
NUM DINT Total number of locked stations
Indicates that the locked time has reached the time-up
OUT TUP BOOL FALSE: Before time-up
TRUE: After time-up
Indicates whether or not the number of locked stations has
exceeded the maximum allowable number
NOV BOOL
FALSE: The maximum allowable number is not exceeded
TRUE: The maximum allowable number is exceeded

n Description
SYS_FORCE_LT is a function block for forcing management of SCS link transmission data.
l Input
UNLK is an input terminal for the signal to unlocking all the locked SCS link transmission
data. When UNLK changes from FALSE to TRUE, all the locked data of the stations will be
forcibly unlocked. Set FALSE to UNLK, if unlocking will not be performed.
Specify the monitoring time of the locking status to CHKT. If the status where one or
more stations are locked continues longer than the monitoring time specified by CHKT, a
diagnostic information message is generated to inform the user. Diagnostic information
messages are re-generated at intervals corresponding to the monitoring time specified by
CHKT.
FORC is used as the maximum number of simultaneously locked SCS link transmission
data of a station.
If NUM becomes greater than FORC, a diagnostic information message is generated to
inform the user that the specified maximum number is exceeded. Note that if NUM becomes
equal to or smaller than FORC, a diagnostic information message notifying about the
recovery is generated.
l Output
LOCK is used to indicate if there is any station that contains the locked SCS link
transmission data. Even a single locked station exists, LOCK will be come TRUE.
NUM indicates the number of locked stations. This is the number of all the locked stations
including the sending and receiving stations. A station means either FCS or SCS.
TUP indicates the status that the locked time at least in one station has exceeded the set
value of CHKT.
NOV is an output that indicates whether or not the number of locked stations has exceeded
the maximum allowable number specified by FORC.
n Remarks
This system function block can be used in new SCS databases created by SENG of R1.03.00 or
later.


The time-up period of the monitoring time of lock status (CHKT) is different from the actual SCS.
In SCS simulation tests, the application logic operates in 1-second cycle. For this reason, even if
the scan period of application logic is set to shorter than 1 second, it operates in 1-second cycle
in SCS simulation tests. If the scan period of application logic is set to shorter than 1 second, the
time-up period becomes longer than the time specified by the input parameter.

generated either.
Table Arguments of SYS_FORCE_LT at Logic Simulation Test
UNLK Invalid Disables forcibly unlocking.
IN CHKT Invalid Disables monitoring the locked time.
FORC Invalid Disables monitoring the number of forcing permissions.
LOCK FALSE
NUM 0
OUT Always output as unlocked.
TUP FALSE
NOV FALSE

<C9.4 SYS_FORCE_BD (Inter-SCS Safety Communication Forcing Status Management)> C9-9
C9.4 SYS_FORCE_BD (Inter-SCS Safety

Communication Forcing Status
Management)
A SYS_FORCE_BD function block manages the lock status of inter-SCS safety
communication data.
SYS_FORCE_BD
UNLK LOCK
CHKT NUM
FORC TUP
NOV
C090401E.ai
Figure SYS_FORCE_BD
n Arguments
Table Arguments of SYS_FORCE_BD
Forcibly cancel locking of all function blocks for inter-SCS safety
communication
UNLK BOOL
From FALSE to TRUE: Forcibly cancel
Other: Do nothing
Monitoring time of locking status of function block for inter-SCS safety
communication. If the time elapsed after locking inter-SCS safety function
CHKT TIME
IN block exceeds CHKT, a diagnostic information message is notified to the
user. If 0 is specified, exceeded time is not checked.
The maximum number of stations for which locking is permitted at the same
time. If the number of stations whose inter-SCS safety communication
FORC DINT function block is locked exceeds FORC, the fact is notified to the user
via diagnostic information messages. If FORC < 0 is specified, the block
functions as if FORC = 0 is specified.
Presence of locked stations
TRUE: 1 or more stations
NUM DINT The total number of locked stations
Indicates if the elapsed time after locking exceeds the monitoring time
OUT (CHKT)
TUP BOOL
FALSE: Not exceeded
TRUE: Exceeded
Indicates if the number of locked stations exceeds the maximum allowed
number (FORC)
NOV BOOL
FALSE: Not exceeded
TRUE: Exceeded the allowed maximum number

n Description
The SYS_FORCE_BD function block is used to manage the lock status of inter-SCS safety
communication function blocks.
l Input
UNLK is an input to forcibly cancel the lock status of all inter-SCS safety communication
function blocks. If the value of UNLK changes from FALSE to TRUE, all locked stations
are forcibly unlocked. UNLK should remain at FALSE if it is desired not to perform forced
cancellation.
Specify the time to monitor lock status for CHKT. If there is at least one station where the
inter-SCS safety communication function blocks are locked for a period longer than the
monitoring time specified for CHKT, the condition is notified to the user via a diagnostic
information message. Diagnostic information messages are resent at the interval of the
monitoring time specified for CHKT if the inter-SCS safety communication function blocks
remain locked. If CHKT = 0, the elapsed time after locking is not monitored.
For FORC, specify the maximum number of stations whose inter-SCS safety
communication function blocks can be locked at the same time. If NUM becomes greater
than FORC, a diagnostic information message is generated to notify that the specified
maximum number is exceeded. Note that when NUM returns to equal to FORC or smaller, a
diagnostic information message indicating recovery is notified.
l Output
LOCK is an output indicating whether or not any station has locked inter-SCS safety
communication function blocks. If any station is locked, the value of LOCK becomes TRUE.
NUM indicates the number of locked stations.
TUP becomes TRUE if there is at least one station with inter-SCS safety communication
function blocks that continue to be locked for a period longer than the monitoring time
specified with CHKT.
NOV becomes TRUE if the number of locked stations exceeded the maximum allowed
number specified with FORC.
n Remarks
later.


The time-up period of the lock status monitoring time (CHKT) is different from actual SCS. In SCS
simulation tests, the application logic operates in 1-second cycle. For this reason, the application
logic operates in 1-second cycle even if the specified scan period of application logic is less than
1 second.
If the specified scan period of application logic is less than 1 second, the time-up period becomes
longer than the time specified with the input parameter.

All inputs are invalid and outputs are fixed as well. No diagnostic information messages are
notified. The table below shows the details of the input/output parameters.
Table Arguments of SYS_FORCE_BD at Logic Simulation Tests
UNLK Invalid Specification of forced lock cancellation is invalid.
No notification is made even if the lock status monitoring time is
IN CHKT Invalid
exceeded.
FORC Invalid No notification is made for the allowable number of locked stations.
LOCk FALSE
NUM 0
OUT Always output as not locked
TUP FALSE
NOV FALSE

<C9.5 SYS_LTSTS (SCS Link Transmission Reception Status Monitor)> C9-12
C9.5 SYS_LTSTS (SCS Link Transmission

Reception Status Monitor)
A SYS_LTSTS function block is used for indicating the reception status of SCS link
transmission.
SYS_LTSTS
STN STS
DIAG
PALM
C090501E.ai
Figure SYS_LTSTS
n Arguments
Table Arguments of SYS_LTSTS
IN STN DINT The station number (1 to 64) of the monitored station
Indicates the reception data status
STS BOOL TRUE: GOOD
FALSE: BAD
Diagnosis notification on the reception station
OUT DIAG BOOL TRUE: Communication data error occurred
FALSE: Communication data error not occurred
Transmission delay pre-alarm on the reception station
PALM BOOL TRUE: Transmission delay occurred
FALSE: Transmission delay not occurred

n Description
SYS_LTSTS is a function block for monitoring the reception status of SCS link transmission data
of a station.
l Input
A station number (1 to 64) needs to be specified for STN.
When a number smaller than 1 or greater than 64 is specified, the STS will become FALSE,
DIAG will become TRUE and PALM will become FALSE.
l Output
STS indicates the data status of logical data in link transmission data area.
The data status output from STS is the same as the output of STS in LTFCS and LTRCV
blocks.
The STS will be held when the link transmission data of the designated station are locked.
DIAG indicates the diagnosis result for the SCS link transmission data input to the station.
The reception status of the link transmission data will be indicated by DIAG regardless if the
SCS link transmission data are locked or not.
PALM is the pre-alarm of SCS link transmission delay. This alarm is initiated before the
delay reaches the time-up value (DLYT).
To initiate the pre-alarm, set the value of the pre-alarm (PALT) on the SCS Link
When the SCS link transmission delay reaches PALT, PALM will become TRUE. If PALT is
set with 0, the pre-alarm will be disabled. Thus PALM will be fixed as FALSE.
l Case when the FCS is Specified as the Station Number

If the target station is specified with FCS, the link transmission delay pre-alarm will be disabled.
PALM will be fixed as FALSE.
l If the Specified Station is not Defined as Receive Station (including the local
station)
If a station not defined as a receiving station on SCS Link Transmission Builder is specified, the
STS will become FALSE, DIAG will become TRUE and PALM will become FALSE.
n Remarks
later.


The input/output parameters of the SYS_LTSTS function block operate in the same way as in the
actual SCS.

The SCS link transmission is invalid. All the inputs are invalid and all the outputs are fixed.
Diagnostic information messages are not generated either.
Table Arguments of SYS_LTSTS at Logic Simulation Test
IN STN Invalid The station number is invalid.
STS TRUE Always indicates normal status (TRUE,normal value:GOOD).
OUT DIAG FALSE Always indicates normal status (FALSE).
PALM FALSE Always indicates normal status (FALSE).

<C9.6 SYS_DIAG (Diagnostic Information Output)> C9-15
C9.6 SYS_DIAG (Diagnostic Information Output)

A SYS_DIAG system function block detects whether or not there are any errors in the
entire system, other than users operation mistakes.
SYS_DIAG
DIAG
IOER
VNER
IRER
CMER
OTER
C090601E.ai
Figure SYS_DIAG
n Arguments
Table Arguments of SYS_DIAG
Presence of errors in the entire system, other than users operation
mistakes
DIAG BOOL
FALSE: Normal status
TRUE: Abnormal status
Presence of I/O related errors
IOER BOOL FALSE: Normal status
Presence of control bus related errors
VNER BOOL FALSE: Normal status
TRUE: Abnormal status (communication impossible)
OUT Presence of IRIG-B related errors (fixed to FALSE if IRIG-B is not
specified for the time synchronization method)
IRER BOOL
Presence of inter-SCS safety communication errors (Consumer error
only) or SCS Link Transmission errors
CMER BOOL
Presence of other errors
OTER BOOL FALSE: Normal status

<C9.6 SYS_DIAG (Diagnostic Information Output)> C9-16
n Description
The SYS_DIAG system function block detects the presence of errors in the entire system, other
than users operation mistakes. It outputs the current status regardless of the operations in the
Diagnostic Information window of the SENG.
DIAG indicates the presence of errors in the entire system. This output is the logical OR of
all other output arguments.
IOER indicates presence of errors related to inputs and outputs (including all AIO/DIO
modules and communication modules). It indicates abnormal status (TRUE) if nodes or
input/output modules do not exist as defined as well.
VNER indicates the presence of errors related to the control bus communication. It indicates
TRUE (communication failure) if the control bus communication has completely failed.
SEE
ALSO For detecting the abnormality on each bus of the redundant buses, SYS_NETST can be used. For more
information, see the following:
C10.4, SYS_NETST (Control Bus Status Indicator)
IRER indicates the presence of errors related to IRIG-B. It indicates normal status (FALSE)
if IRIG-B is not specified for the time synchronization method.
CMER indicates the presence of errors in inter-SCS safety communication and SCS link
transmission.
If all the reception data of inter-SCS safety communication consumer FBs are normal
(*1) and all the reception data of SCS link transmission are normal (*2), CMER will output
FALSE (normal status).
*1: It takes it as normal when the consumer side does not have any consumer FB.
*2: It takes it as normal when the reception of SCS link transmission is not defined. SCS link transmission includes SCS link
transmission safety communication and SCS global switch communication.
OTER indicates the presence of other errors (*1). It indicates abnormal status (TRUE) if
HKU does not exist as defined as well.
*1: If CPU modules are redundantly configured, one module shows failure.
FAN is abnormal (If FAN exists in the configuration).
CPU node IN/OUT temperature is abnormal.
Battery is abnormal.
Battery switch is off.
n Remarks
Use SYS_FORCE system function blocks to detect users mistakes in lock operations, SYS_
OVR system function blocks to detect mistakes in override operations, SYS_PSWD system
function blocks to detect mistakes in operating switches with passwords, and SYS_SECURE
system function blocks to detect operation mistakes at the security level.
Any error status can be detected by referencing the SYS_DIAG system function block with the
system function blocks described above.

SCS simulator indicates all the hardware related diagnosis status as normal (FALSE).

All the outputs are always fixed to no error detection (FALSE).

<C9.7 SYS_SECURE (Security Level Management)> C9-17
C9.7 SYS_SECURE (Security Level Management)

A SYS_SECURE system function block controls the security level of an SCS.
SYS_SECURE
RST LVL
CHKT TUP
C090701E.ai
Figure SYS_SECURE
n Arguments
Table Arguments of SYS_SECURE
RST BOOL Security level reset input (reset only at change from FALSE to TRUE)
IN Watching time of Security level
CHKT TIME
0 may disable the watching timer
LVL DINT Current security level
OUT Security level monitoring time overrun
TUP BOOL FALSE: The monitoring time is not exceeded
TRUE: The monitoring time is exceeded
n Description
The SYS_SECURE system function block controls the security level of an SCS.
Output parameter LVL indicates the current security level.

The SYS_SECURE system function block forces the setting of the security level of SCS from
Level1 to Level2 when the input value of RST changes from FALSE to TRUE. SYS_SECURE
system function block cannot change the security level of SCS from Level0 to Level2.
If you connect RST to the discrete input, you can use it to reset the security level when SENG
fails or a communication error occurs. Set the RST to FALSE when resetting from the discrete
input is not necessary.
The SYS_SECURE system function block monitors the security level. If Level1 continues
longer than the monitoring time specified by input argument CHKT, the SYS_SECURE system
function block generates a diagnostic information message and sets TUP to TRUE. Diagnostic
information messages are regenerated at intervals corresponding to the monitoring time
specified by CHKT as long as Level1 continues.
n Remarks
The status of security level 0 (offline level) is not monitored.

<C9.7 SYS_SECURE (Security Level Management)> C9-18

The security level monitoring time (CHKT) on SCS simulator and on actual SCS may take

generated either.
Table Arguments of the SYS_SECURE System Function Block at Logic Simulation Tests
Invalid. The security level is not reset regardless of the
RST Invalid
IN input value
LVL 2 Always fixed to Level 2.
OUT
TUP FALSE Always fixed to no error (FALSE).

<C9.8 SYS_SEC_CTL (Security Level Protection)> C9-19
C9.8 SYS_SEC_CTL (Security Level Protection)

A SYS_SEC_CTL system function block provides protection against operations to change
the security level of a given SCS via password entry from the SENG.
SYS_SEC_CTL
FIX STS
C090801E.ai
Figure SYS_SEC_CTL
n Arguments
Table Arguments of SYS_SEC_CTL
Specifies whether or not to disable security level
change.
TRUE: Disable change operations via password entry
IN FIX BOOL
from the SENG.
FALSE: Enable change operations via password entry
from the SENG.
Indicates whether or not security level change via
password entry is disabled.
OUT STS BOOL
TRUE: Security level change is disabled.
FALSE: Security level change is enabled.
n Description
The SYS_SEC_CTL system function block can be used to disable operations to change the
security level of a given SCS via password entry from the SENG. This system function block
permits stricter control of security-level change operations targeting SCS.
If the input parameter FIX of the SYS_SEC_CTL system function block is TRUE, all
attempts to change the security level via password entry from the SENG are disabled. The
applicable SCS returns an error to SENG from which a security-level change request was
received.
The SYS_SEC_CTL system function block also controls security level reset to level 2.
Changing the security level of a given SCS via password entry from the SENG is actually
enabled or disabled from the next scan period after the FIX value was changed.
Enabling/disabling of security-level change operations is notified by a diagnostic information
message.
Even when security-level change operations via password entry are disabled, passwords
assigned for security level change can still be changed.

<C9.8 SYS_SEC_CTL (Security Level Protection)> C9-20
n Remarks
Whether security level changes via password entry from the SENG are enabled or disabled
is not notified on the SCS State Management Window.
Even when security level changes to an SCS are disabled by the SYS_SEC_CTL system
function block, the security level of the SCS can still be reset to level 2 using the RST input
from the SYS_SECURE system function block or via the restart switch operation of the CPU
module.
This system function block can be used in new SCS databases created by SENG of
R1.01.30 or later.

The input/output parameters of the SYS_SEC_CTL function block operate in the same way as in
the actual SCS.

Inputs are invalid and STS always outputs FALSE.

<C9.9 SYS_OVR (Override Function Blocks Management)> C9-21
C9.9 SYS_OVR (Override Function Blocks

Management)
A SYS_OVR system function block manages all instances of the override function blocks.
SYS_OVR
UNOV OVR
CKTO NUMO
OVRC TUPO
CKTS
NOVO
SWC
SWON
NUMS
TUPS
NOVS
C090901E.ai
Figure SYS_OVR

n Arguments
Table Arguments of SYS_OVR
Override forced cancellation command (only at change from FALSE to
UNOV BOOL
TRUE)
Time to monitor existence of instances in the override status. CKTO=0
CKTO TIME
disables the watching timer
Maximum number of instances that can be placed in the override
OVRC DINT status at the same time
IN
OVRC < 0 equivalent to OVRC = 0
Time to monitor existence of instances in the status where override
CKTS TIME
operation is allowed. CKTS=0 disables the watching timer
Maximum number of instances that can be placed in the status where
SWC DINT override operation is allowed at the same time
SWC < 0 equivalent to SWC = 0
Indicates whether or not any instances are in the override status
OVR BOOL FALSE: None
TRUE: At least one instance
NUMO DINT Number of instances in the override status
Indicates whether or not any instances have been in the override
status longer than the monitoring time
FALSE: There are no instances in the override status exceeding the
TUPO BOOL
monitoring time
TRUE: There are instances in the override status exceeding the
monitoring time
Indicates whether or not the number of instances in the override status
at the same time exceeds the maximum number
NOVO BOOL
FALSE: The maximum number is not exceeded
TRUE: The maximum number is exceeded
OUT Indicates whether or not any instances are in the status where override
operation is allowed
SWON BOOL
FALSE: None
TRUE: At lease one instance
NUMS DINT Number of instances in the status where override operation is allowed
Indicates whether or not any instances have been in the status where
override operation is allowed longer than the monitoring time
FALSE: There are no instances in the status where override operation
TUPS BOOL
is allowed exceeding the monitoring time
TRUE: There are instances in the status where override operation is
allowed exceeding the monitoring time
Indicates whether or not the number of instances in the status where
override operation is allowed at the same time exceeds the maximum
NOVS BOOL number

n Description
The SYS_OVR system function block is used to manage all instances of override function blocks
and grouping override function blocks within an SCS. It allows forced cancellation of the override
status, alarm setting for the override operation and status output.
l Forced Cancellation of the Override Status

When UNOV changes from FALSE to TRUE, the instances of override function block and
grouping override function block will be released from override status. Once cancelled, each
instance generates a system alarm. The override status is cancelled whether the input to SW of a
given instance is TRUE or FALSE.
l Management of the Override Status
SEE
ALSO For more information about the actions of the parameters, see the following:
D3.5, Status Management of Function Blocks Used for Override
l Management of the Status Where Override Operation is Allowed

SWON indicates whether or not there are instances in the status where an override
operation is allowed (TRUE is input to input parameter SW). It outputs TRUE if there are any
instances in the status where an override operation is allowed.
NUMS outputs the number of instances in the status where an override operation is
allowed.
Specify the time to monitor the existence of instances in the status where an override
operation is allowed for CKTS. A system alarm is generated if the status where at least one
instance is in the status where an override operation is allowed continues longer than the
monitoring time specified by CKTS. System alarms are re-generated at intervals
corresponding to the time specified for CKTS if this status continues.
TUPS indicates whether or not there are instances that have been in the status where an
override operation is allowed longer than the monitoring time specified by CKTS. It outputs
TRUE if the status where one or more instances are in the status where an override
operation is allowed continues longer than the monitoring time specified by CKTS.
Specify the maximum number of instances that can be placed in the status where an
override operation is allowed at the same time in an SCS for SWC. A system alarm is
generated if NUMS becomes greater than SWC. Although a system alarm is generated,
it is still possible to place more instances than the maximum number specified by SWC in
the status where an override operation is allowed. Note that if NUMS becomes equal to or
smaller than SWC, a system alarm notifying about the recovery is generated.
NOVS indicates whether or not more instances than the maximum number of instances
that can be placed in the status where an override operation is allowed at the same time
specified by SWC are in the status where an override operation is allowed. It outputs TRUE
if more instances than the maximum number are in the status where an override operation
is allowed.


The override status monitoring time (CKTO, CKTS) on SCS simulator and on actual SCS may
take different time to reach time-up.

The CENTUM integration function is invalid. For this reason, all the inputs of the SYS_OVR
system function block are invalid and all the outputs are fixed. The system function block
operates as if no override operation is performed. System alarms are not generated either.
Table Arguments of the SYS_OVR System Function Block at Logic Simulation Tests
UNOV Invalid
CKTO Invalid
IN OVRC Invalid
CKTS Invalid
SWC Invalid
OVR FALSE Always indicates no instances in the override status (FALSE).
NUMO 0 The number of instances in the override status is always 0.
TUPO FALSE Always indicates normal status (FALSE).
NOVO FALSE Always indicates normal status (FALSE).
OUT SWON FALSE Always indicates override not allowed (FALSE).
The number of instances in the status where override is allowed is
NUMS 0
always 0.
TUPS FALSE Always indicates normal status (FALSE).
NOVS FALSE Always indicates normal status (FALSE).

<C9.10 SYS_PSWD (Password Function Blocks Management)> C9-25
C9.10 SYS_PSWD (Password Function Blocks

Management)
A SYS_PSWD system function block manages all instances of the password function
blocks within an SCS.
SYS_PSWD
UNPW PSWD
CHKT NUM
PSWC TUP
NOV
C091001E.ai
Figure SYS_PSWD
n Arguments
Table Arguments of SYS_PSWD
Forcibly sets the OUT outputs of all password function block instances
UNPW BOOL
to FALSE (only at change from FALSE to TRUE)
Time to monitor the status where active password function block
CHKT TIME instances outputs TRUE from the OUT output
IN
0 disables the watching timer
Maximum number of active password function block instances that can
PSWC DINT output TRUE from the OUT output at the same time
PSWC < 0 equivalent to PSWC = 0
Indicates whether or not there are any active password function block
instances that output TRUE from the OUT output
PSWD BOOL
FALSE: None
TRUE: At least one FB
Total number of active password function block instances that output
NUM DINT
TRUE from the OUT output
Flag indicating whether or not a password function block instance has
been outputting TRUE from the OUT output longer than the monitoring
OUT time specified by CHKT
TUP BOOL FALSE: There are no password function block instances outputting
TRUE longer than the monitoring time
TRUE: There are password function block instances outputting TRUE
longer than the monitoring time
Flag indicating whether or not the number of active password function
block instances outputting TRUE from the OUT output exceeds the
NOV BOOL maximum number specified by PSWC

n Description
The SYS_PSWD system function block is used to manage all instances of the password function
blocks. It allows forced cancellation of the OUT output of all instances, alarm setting for instance
operation and status output.
If UNPW changes from FALSE to TRUE, the OUT outputs of all instances of the password
function blocks are forcibly set to FALSE. Each instance whose OUT output was changed
generates a system alarm.
PSWD indicates whether or not there are password function block instances that output
TRUE from the OUT output.
NUM outputs the number of password function block instances that output TRUE from the
OUT output.
Specify the maximum number of password function block instances that can output TRUE
from the OUT output at the same time for PSWC. A system alarm is generated if NUM
becomes greater than PSWC. Although a system alarm is generated, it is still possible for
more instances to output TRUE than the maximum number specified by PSWC. If NUM
becomes equal to or smaller than PSWC, a system alarm notifying about the recovery is
generated.
NOV indicates whether or not more password function block instances than the maximum
number specified by PSWC output TRUE from OUT.
A system alarm is generated if the status where at least one password function block
instance outputs TRUE from the OUT output continues longer than the monitoring time
specified by CHKT. System alarms are re-generated at intervals corresponding to the
monitoring time specified for CHKT if this status continues.
TUP indicates whether or not there are password function block instances that have been
outputting TRUE from OUT longer than the monitoring time specified by CHKT.


The active instance existence time (CHKT) on SCS simulator and on actual SCS may take

The CENTUM integration function is invalid. For this reason, all the inputs of the SYS_PSWD
system function block are invalid and all the outputs are fixed. System alarms are not generated
either.
Table Arguments of SYS_PSWD System Function Block at Logic Simulation Tests
UNPW Invalid All inputs are invalid.
IN CHKT Invalid All inputs are invalid.
PSWC Invalid All inputs are invalid.
PSWD FALSE Always outputs TRUE.
NUM 0 Always 0.
OUT
TUP FALSE Always indicates normal status (FALSE).
NOV FALSE Always indicates normal status (FALSE).

<C9.11 SYS_ALLSD (Station Output Shutdown)> C9-28
C9.11 SYS_ALLSD (Station Output Shutdown)

A SYS_ALLSD system function block shuts down all output channels of safety output
modules defined in a station at the same time.
SYS_ALLSD
NTRG
C091101E.ai
Figure SYS_ALLSD
n Arguments
Table Arguments of SYS_ALLSD
Shutdown execution switch
IN NTRG BOOL TRUE: Do not shut down
FALSE: Shut down
n Description
A SYS_ALLSD system function block shuts down all output channels of safety output modules
defined in a station at the same time.
Shutdown is not executed as long as TRUE is input to NTRG. However, as soon as the value of
NTRG changes from TRUE to FALSE, all output channels in a station are shut down at once.
As long as FALSE is input to NTRG, all the target output channels are placed in disable status
and all output modules output Output value at fault. Output enable operation is not executed as
long as FALSE is input to NTRG; instead, the output disable status is retained.
n Remarks
R1.02.00 or later.
The targets of shutdown are limited to safety output modules (AO and DO) only. This system
function block has no effect on modules other than AO and DO. SYS_ALLSD does not
operate if no output modules are defined in I/O Wiring View.
The shutdown processing is not performed on channels of safety output modules that are
locked even if the value of NTRG changes from TRUE to FALSE. The current output value
is retained for these channels. If the value of an output variable of a locked output module is
changed via forcing, the changed value is output.

<C9.11 SYS_ALLSD (Station Output Shutdown)> C9-29

The input parameters of the SYS_ALLSD function block operate in the same way as in the actual
SCS.
However, the communication with physical modules cannot be established.

All input parameters of SYS_ALLSD are invalid. The shutdown processing is not executed.
Table Arguments of SYS_ALLSD at Logic Simulation Test
IN NTRG Invalid The shutdown execution switch is invalid.

<C9.12 SYS_IOSD (Module Output Shutdown)> C9-30
C9.12 SYS_IOSD (Module Output Shutdown)

A SYS_IOSD system function block shuts down all output channels of a safety output
module specified by a node number (NODE) and slot number (SLOT) at the same time.
SYS_IOSD
NTRG
NODE
SLOT
C091201E.ai
Figure SYS_IOSD
n Arguments
Table Arguments of SYS_IOSD
Shutdown execution switch
NTLG BOOL TRUE: Do not shut down
FALSE: Shut down
IN
NODE DINT Node number (1 to 14)
SLOT DINT Output module installation slot number (1 to 8)
n Description
A SYS_IOSD system function block shuts down all output channels of a safety output module
specified by a node number (NODE) and slot number (SLOT) at the same time.
Shutdown is not executed as long as TRUE is input to NTRG. However, as soon as the value
of NTRG changes from TRUE to FALSE, all output channels of the specified output module are
shut down at once.
As long as FALSE is input to NTRG, all the target output channels are placed in disable status
and this module outputs the Output value at fault. Output enable operation is not executed as
long as FALSE is input to NTRG; instead, the output disable status is retained.
Define only one SYS_IOSD system function block in the case of redundant output modules.
In order to shut down redundant output modules, specify an odd slot number. By default, a
SYS_IOSD system function block shuts down an output module that has the control right.

<C9.12 SYS_IOSD (Module Output Shutdown)> C9-31
n Remarks
R1.02.00 or later.
The targets of shutdown are limited to safety output modules (AO and DO) only. This
system function block has no effect on modules other than AO and DO. SYS_IOSD does
not operate if the specified module is not defined in I/O Wiring View.
If the value of NTRG changes from TRUE to FALSE while a safety output module is locked,
the shutdown processing is not performed. The current output value is retained for that
output module. If the value of an output variable of a locked output module is changed via
forcing, the changed value is output.

The input parameters of the SYS_IOSD function block operate in the same way as in the actual
SCS.
However, the communication with physical modules cannot be established.

All input parameters of SYS_IOSD are invalid. The shutdown processing is not executed.
Table Arguments of SYS_ SYS_IOSD at Logic Simulation Test
NTRG Invalid The shutdown execution switch is invalid.
IN NODE Invalid The node number is invalid.
SLOT Invalid The slot number is invalid.

<C9.13 SYS_IOALLST (All I/O Channels of SCS Status Indicator)> C9-32
C9.13 SYS_IOALLST (All I/O Channels of SCS

Status Indicator)
A SYS_IOALLST system function block indicates the data status of all input channels and
all output channels of all AIO/DIO modules of an SCS.
SYS_IOALLST
NRO
NRI
C091301E.ai
Figure SYS_IOALLST
n Arguments
Table Arguments of SYS_IOALLST
Indicates whether or not the data statuses of all output channels are
normal
NRO BOOL
TRUE: All channels are normal
FALSE: At least one channel is abnormal
OUT
Indicates whether or not the data statuses of all input channels are
normal
NRI BOOL
n Description
The SYS_IOALLST system function block indicates the data status of all input channels and all
output channels of all AIO/DIO modules of an SCS. The SYS_IOALLST system function block
can be used when creating applications that treat errors in one or more channels as demands.
NRO indicates whether or not the data statuses of all output channels are normal. It becomes
TRUE if the data statuses of all the channels are normal. Channels not used (*1) are excluded
from the targets of judgment.
NRI indicates whether or not the data statuses of all input channels are normal. It becomes
from the targets of judgment. The statuses of communication modules are ignored.
*1: Channels not used refer to channels to which input/output variables are not assigned.
n Remarks
The SYS_IOALLST system function block references the data status of the logical data of input/
output variables. For this reason, the outputs of the SYS_IOALLST system function block are
affected by the lock operation of modules. Please be aware that if modules/channels and input/
output variables are locked, the outputs may differ from the physical states.

<C9.13 SYS_IOALLST (All I/O Channels of SCS Status Indicator)> C9-33

The communication with physical modules cannot be established.
The data status of each channel (NRO, NRI) is determined by the data status of the logical data
of each channel. The initial data status of logical data is GOOD.

All the outputs are fixed. The SYS_IOALLST system function block is not affected even if the data
status of an input/output variable is changed.
Table Arguments of the SYS_IOALLST System Function Block at Logic Simulation Tests
NRO TRUE Always outputs TRUE.
OUT
NRI TRUE Always outputs TRUE.

<C9.14 SYS_NODEST (All I/O Channels of Node Status Indicator)> C9-34
C9.14 SYS_NODEST (All I/O Channels of Node

Status Indicator)
A SYS_NODEST system function block indicates the representative data status of all
input channels and output channels within the specified node.
SYS_NODEST
NODE NRO
NRI
C091401E.ai
Figure SYS_NODEST
n Arguments
Table Arguments of SYS_NODEST
IN NODE DINT Node number (1 to 14)
Indicates whether or not the data statuses of all output channels
within the node are normal
NRO BOOL
OUT
Indicates whether or not the data statuses of all input channels within
the node are normal
NRI BOOL
n Description
The SYS_NODEST system function block indicates the data status of all input channels and
all output channels of AIO/DIO modules within the specified node. The SYS_NODEST system
function block can be used when creating applications that treat errors in one or more channels in
the specified node as demands.
NRO indicates whether or not the data statuses of all output channels are normal. It becomes
from the targets of judgment.
NRI indicates whether or not the data statuses of all input channels are normal. It becomes
from the targets of judgment. The statuses of communication modules are ignored.

<C9.14 SYS_NODEST (All I/O Channels of Node Status Indicator)> C9-35
n Remarks
The SYS_NODEST system function block references the data status of the logical data of input/
output variables. For this reason, the outputs of the SYS_NODEST system function block are
output variables are locked, the outputs may differ from the physical states.
If no node corresponds to the node number specified to IN, the outputs of NRO and NRI will
become FALSE to indicate error.

The data status of each channel (NRO, NRI) is determined by the data status of the logical data
of each channel. The initial data status of logical data is GOOD.

All the outputs are fixed. The SYS_NODEST system function block is not affected even if the
data status of an input/output variable is changed.
Table Arguments of the SYS_NODEST System Function Block at Logic Simulation Tests
IN NODE Invalid Node number is invalid.
NRO TRUE Always outputs TRUE.
OUT
NRI TRUE Always outputs TRUE.

<C9.15 SYS_OUTST (Output Module 8 Channels Indicator)> C9-36
C9.15 SYS_OUTST (Output Module 8 Channels

Indicator)
A SYS_OUTST system function block indicates the data status of all output channels of
the specified output module.
SYS_OUTST
NODE NRAL
SLOT NROR
CH1
CH2
CH3
CH4
CH5
CH6
CH7
CH8
C091501E.ai
Figure SYS_OUTST
n Arguments
Table Arguments of SYS_OUTST
IN
SLOT DINT Slot number of the output module (1 to 8)
Indicates whether or not the data statuses of all channels are normal
NRAL BOOL TRUE: All channels are normal
Indicates whether or not the data status of one or more channels is
normal
NROR BOOL
TRUE: At least one channel is normal
FALSE: All channels are abnormal
Indicates the data status of CH1
OUT CH1 BOOL TRUE: GOOD
FALSE: BAD
CH2 BOOL TRUE: GOOD
FALSE: BAD
: :
CH8 BOOL TRUE: GOOD
FALSE: BAD

n Description
The SYS_OUTST system function block indicates the data status of all channels of the specified
output module.
l Input
Specify a value in the range from 1 to 8 for the slot number (SLOT). Specify an odd slot number
for redundant output modules. The SYS_OUTST system function block indicates the status of
the output module with the control right. Define only one SYS_OUTST system function block
even when output modules are placed in redundant configuration.
l Output
NRAL indicates whether or not the data statuses of all channels are normal. It becomes
TRUE if the data statuses of all the channels are normal. Channels not used (*1) are
excluded from the test object.
NROR indicates whether or not the data status of at least one channel is normal. It only
becomes FALSE if the data statuses of all the channels are abnormal. Channels not used
(*1) are excluded from the test object.
CH1 to CH8 indicate the data status of each channel. Abnormal status (FALSE) is output for
channels not used (*1).
*1: Channels not used are the channels to which input/output variables are not assigned.
If a 4-channel output module is specified, CH5 to CH8 are treated as unused channels as well.
n Remarks
The SYS_OUTST system function block references the data status of the logical data of output
variables. For this reason, the outputs of the SYS_OUTST system function block are affected by
the lock operation of modules. Please be aware that if modules/channels and output variables
are locked, the outputs may differ from the physical data status.
If no module is defined in the specified position, or if the defined module is not an output module
or is a communication module, the abnormal status (FALSE) will be output to NRAL, NROR and
CH1 to CH8. Use a SYS_INST or SYS_CHST system function blocks for input modules.


The data status of each channel (NRAL, NROR, CH1 to CH8) is determined by the data status of
the logical data of each channel. The initial data status of logical data is GOOD.

All the inputs are invalid and all the outputs are fixed. The SYS_OUTST system function block is
not affected even if the data status of an input/output variable is changed.
Table Arguments of the SYS_OUTST System Function Block at Logic Simulation Tests
NODE Invalid Node number is invalid.
IN
SLOT Invalid Slot number is invalid.
NRAL TRUE Always indicates normal status (TRUE).
NROR TRUE Always indicates normal status (TRUE).
CH1 TRUE Always indicates normal status (TRUE).
OUT
: :

<C9.16 SYS_OUTST16 (Output Module 16 Channels Indicator)> C9-39
C9.16 SYS_OUTST16 (Output Module 16 Channels

Indicator)
A SYS_OUTST16 system function block outputs the data statuses of all channels of a
specified 16-channel output module.
SYS_OUTST16
NODE NRAL
SLOT NROR
CH1
CH2
CH3
CH4
CH5
CH6
CH7
CH8
CH9
CH10
CH11
CH12
CH13
CH14
CH15
CH16
C091601E.ai
Figure SYS_OUTST16
n Arguments
Table Arguments of SYS_OUTST16
IN
Whether or not the data statuses of all channels are normal
Whether or not the data status of at least 1 channel is normal
NROR BOOL TRUE: At least one channel is normal
CH1 BOOL TRUE: GOOD
OUT FALSE: BAD
CH2 BOOL TRUE: GOOD
FALSE: BAD
: :
CH16 BOOL TRUE: GOOD
FALSE: BAD

n Description
A SYS_OUTST16 system function block outputs the data statuses of all channels of an output
module specified by a node number and slot number. Use this FB for 16-channel output modules.
n Input
for redundant output modules. A SYS_OUTST16 system function block outputs the status of an
output module that has the control right. Define only one SYS_OUTST16 system function block
in the case of redundant output modules.
n Output
NRAL indicates whether or not the data statuses of all channels are normal. It outputs TRUE
if the data statuses of all channels are normal. The data statuses of unused channels (*1)
are not judged.
NROR indicates whether or not the data status of at least one channel is normal. It outputs
FALSE only if the data statuses of all channels are abnormal. The data statuses of unused
channels (*1) are not judged.
CH1 to CH16 output data status of each channel. They output FALSE for unused channels
(*1).
*1: Unused channels are the channels to which no output variable is assigned.
Under the following circumstances, some channels may be treated as unused channels.
CH5 to CH16 channels will be treated as unused channels if a 4-channel output module is specified.
CH9 to CH16 channels will be treated as unused channels if an 8-channel output module is specified.
n Remarks
A SYS_OUTST16 system function block refers to the data status of logical data of an
output variable. For this reason, the output of the SYS_OUTST16 system function block is
influenced by module lock operation. Note that the output value may be different if a module,
channel or output variable is locked, compared to when it is not locked.
FALSE is output to NRAL, NROR and CH1 to CH16 if a module is not defined in the
specified location in I/O Wiring View, or the specified module is not an output module, e.g., a
communication module. Use SYS_INST or SYS_CHST for input modules.
R1.02.00 or later.


The data status of each channel (NRAL, NROR, CH1 to CH16) is determined by the data status
of the logical data of each channel. The initial data status of logical data is GOOD.

All input parameters of SYS_OUTST16 are invalid and a fixed value is output for all output
parameters. This system function block is not affected even if the data status of an output
variable is changed.
Table Arguments of SYS_OUTST16 at Logic Simulation Tests
NODE Invalid The node number is invalid.
IN
NRAL TRUE Always outputs normal (TRUE)
NROR TRUE Always outputs normal (TRUE)
CH1 TRUE Always outputs GOOD (TRUE)
OUT
: :

<C9.17 SYS_INST (Input Module Status Indicator)> C9-42
C9.17 SYS_INST (Input Module Status Indicator)

A SYS_INST system function block indicates the representative data status of all
channels of the specified input module.
SYS_INST
NODE NRAL
SLOT NROR
C091701E.ai
Figure SYS_INST
n Arguments
Table Arguments of SYS_INST
IN
SLOT DINT Input module mounting slot number (1 to 8)
Indicates whether or not the data statuses of all channels are normal
OUT Indicates whether or not the data status of one or more channels is
normal
NROR BOOL
TRUE: At least one channel is normal

<C9.17 SYS_INST (Input Module Status Indicator)> C9-43
n Description
The SYS_INST system function block indicates the representative data status of all channels of
the specified input module.
l Input
for redundant input modules. The SYS_INST system function block indicates the status of the
input module with the control right. Define only one SYS_INST system function block even when
input modules are placed in redundant configuration.
l Output
NRAL indicates whether or not the data statuses of all channels are normal. It becomes
TRUE if the data statuses of all the channels are normal. Channels not used (*1) are
excluded from the targets of judgment.
NROR indicates whether or not the data status of at least one channel is normal. It only
becomes FALSE if the data statuses of all the channels are abnormal. Channels not used
(*1) are excluded from the targets of judgment.
*1: Channels not used are the channels to which input variables are not assigned.
n Remarks
The SYS_INST system function block references the data status of the logical data of input
variables. For this reason, the outputs of the SYS_INST system function block are affected by
the lock operation of modules. Please be aware that if modules/channels and input variables are
locked, the outputs may differ from the physical data status.
If no module is present in the specified position, or if the present module is not an input module
or is a communication module, the abnormal status (FALSE) will be output to NRAL and NROR.
Use a SYS_OUTST or SYS_CHST system function blocks for output modules.

The data status of each channel (NRAL, NROR) is determined by the data status of the logical
data of each channel. The initial data status of logical data is GOOD.

All the inputs are invalid and all the outputs are fixed. The SYS_INST system function block is not
affected even if the data status of an input variable is changed.
Table Arguments of the SYS_INST System Function Block at Logic Simulation Tests
IN
NRAL TRUE Always indicates normal status (TRUE).
OUT
NROR TRUE Always indicates normal status (TRUE).

<C9.18 SYS_CHST (Channel Status Indicator)> C9-44
C9.18 SYS_CHST (Channel Status Indicator)

A SYS_CHST system function block indicates the data status of the specified channel of
the specified AIO/DIO module.
SYS_CHST
NODE Q
SLOT
CHNO
C091801E.ai
Figure SYS_CHST
n Arguments
Table Arguments of SYS_CHST
IN SLOT DINT AIO/DIO module mounting slot number (1 to 8)
CHNO DINT Channel number (1 to 16)
Data status of the channel
OUT Q BOOL TRUE: GOOD
FALSE: BAD
n Description
The SYS_CHST system function block indicates the data status of the specified channel of the
specified AIO/DIO module. If a communication module is specified, FALSE will be output.
l Input
Specify a value in the range from 1 to 8 for the slot number (SLOT). Specify an odd slot
number for redundant AIO/DIO modules. The SYS_CHST system function block indicates
the status of the AIO/DIO module with the control right.
Specify a value in the range from 1 to 16 for the channel number (CHNO).
l Output
Q indicates the data status of the specified channel. If a nonexistent channel is specified, Q
indicates abnormal status (FALSE). Q also indicates abnormal status (FALSE) for channels not
used (*1).

<C9.18 SYS_CHST (Channel Status Indicator)> C9-45
n Remarks
The SYS_CHST system function block references the data status of the logical data of input/
output variables. For this reason, the outputs of the SYS_CHST system function block are
output variables are locked, the outputs may differ from the physical data status.

The data status of each channel (Q) is determined by the data status of the logical data of each
channel. The initial data status of logical data is GOOD.

All the inputs are invalid and the output is fixed. The SYS_CHST system function block is not
affected even if the data status of an input/output variable is changed.
Table Arguments of the SYS_CHST System Function Block at Logic Simulation Tests
IN SLOT Invalid Slot number is invalid.
CHNO Invalid Channel number is invalid.
OUT Q TRUE Always outputs GOOD (TRUE).

<C9.19 SYS_OUTEN (Output Module Status Indicator)> C9-46
C9.19 SYS_OUTEN (Output Module Status

Indicator)
A SYS_OUTEN system function block outputs output enable/output disable status of a 16-
channel safety output module.
SYS_OUTEN
NODE CH1
SLOT CH2
CH3
CH4
CH5
CH6
CH7
CH8
CH9
CH10
CH11
CH12
CH13
CH14
CH15
CH16
C091901E.ai
Figure SYS_OUTEN
n Arguments
Table Arguments of SYS_OUTEN
IN
Output enable/output disable status of CH1
CH1 BOOL TRUE: Output enabled
FALSE: Output disabled
Output enable/output disable status of CH 2
OUT FALSE: Output disabled
: :
Output enable/output disable status of CH16
FALSE: Output disabled
n Description
A SYS_OUTEN system function block outputs output enable/output disable status of a 16-
channel output module. If an 8-channel output module is specified, outputs from CH1 to CH8 are
enabled. Outputs from CH9 to CH16 are disabled and output disabled (FALSE) is always output.

n Input
for redundant output modules. A SYS_OUTEN system function block outputs the status of an
output module that has the control right. Define only one SYS_OUTEN system function block in
the case of redundant output modules.
n Output
A SYS_OUTEN system function block outputs output enable/output disable status of each
channel. Depending on the specified modules, some of the output terminals may be disabled
(FALSE).
If 16-channel, 8-channel or 4-channel output module is specified, SYS_OUTEN outputs the
followings.
16-channel output module
For CH1 to CH16, the output enable/output disable status of each channel is output. Output
disabled (FALSE) is output for channels to which no output variable is assigned.
- Use the output values of CH1 to CH8. Outputs from CH9 to CH16 are disabled.
- For CH1 to CH8, the output enable/output disable status of each channel is output.
Output disabled (FALSE) is output for channels to which no output variable is assigned.
- Output disabled (FALSE) is always output for CH9 to CH16.
- Use the output values of CH1 to CH4. Outputs from CH5 to CH16 are disabled.
- For CH1 to CH4, the output enable/output disable status of each channel is output.
Output disabled (FALSE) is output for channels to which no output variable is assigned.
- Output disabled (FALSE) is always output for CH5 to CH16.
n Remarks
R1.02.00 or later.
The targets of SYS_OUTEN are limited to safety output modules (AO and DO) only. It
outputs output disabled (FALSE) for modules other than AO and DO.
Output enable operation for output modules are normally performed from a SENG, but this
is also possible via the application logic using SYS_STAT.


The input/output parameters of the SYS_OUTEN function block operate in the same way as in
the actual SCS.

All input parameters of SYS_OUTEN are invalid and a fixed value is output for all output
parameters.
Table Arguments of SYS_OUTEN at Logic Simulation Tests
IN
CH1 TRUE Always outputs output enabled (TRUE)
OUT
: :

<C9.20 SYS_CERR (Computation Error Indicator)> C9-49
C9.20 SYS_CERR (Computation Error Indicator)

A SYS_CERR function block notifies the conditions of abnormal calculation occurrence
in the application logic. It is also possible to change the interval of re-warning system
alarms on abnormal calculation occurrence.
IMPORTANT
When the SYS_CERR function block is executed within a user-defined function block, if an
access to outside array range error occurs before executing SYS_CERR in that function block,
SYS_CERR is not executed. Be careful about the execution order of SYS_CERR if it is used in a
user-defined function block.
SYS_CERR
DIVZ
CHKT XARR
FOVF
COVF
C092001E.ai
Figure SYS_CERR
SEE
ALSO For the SCS behavior when an abnormal calculation occurs, see the following:
B6.1.3, Behavior at Abnormal Calculation
n Arguments
Table Arguments of SYS_CERR
Computation error re-warning interval
No re-warning is generated if 0 is specified.
IN CHKT TIME
The default re-warning interval when SYS_CERR is not created is 10
minutes.
Presence of POU with division-by-zero error
DIVZ BOOL FALSE: There are no POUs with division-by-zero error.
TRUE: There are POUs with division-by-zero error.
Presence of POU with access to the outside of an array error
FALSE: There are no POUs with access to the outside of an array
XARR BOOL
error.
OUT TRUE: There are POUs with access to the outside of an array error.
Presence of POU with overflow in floating-point calculation
FOVF BOOL FALSE: There are no POUs with overflow in floating-point calculation.
TRUE: There are POUs with overflow in floating-point calculation.
Presence of POU with overflow in casting
COVF BOOL FALSE: There are no POUs with overflow in casting.
TRUE: There are POUs with overflow in casting.

<C9.20 SYS_CERR (Computation Error Indicator)> C9-50
n Description
The SYS_CERR function block checks computation error conditions. Its output parameters allow
checking occurrence conditions of each computation error type. If one or more computation
errors occur within the SCS, the condition is notified via diagnostic information messages in
10-minute interval by default. The re-warning interval can be changed using the input parameter
CHKT.
n Remarks
later.

In SCS simulation tests, POUs with overflow in floating-point calculation cannot be detected.
Only FOVF is fixed to FALSE. Other parameters operate in the same way as in the actual SCS.

In SCS simulation tests, the computation error detection function is disabled. The specification
of the computation error re-warning interval (CHKT) is invalid. All the outputs are always fixed to
FALSE that indicates no computation error occurrence.

<C9.21 SYS_SCANEXT (Scan Period Extension Indicator)> C9-51
C9.21 SYS_SCANEXT (Scan Period Extension

Indicator)
A SYS_SCANEXT function block notifies if the scan period of the application logic
execution function is actually extended (execution status of scan period automatic
extension) in the SCS if the specification of automatic extension of scan period of the
application logic execution function is enabled.
SYS_SCANEXT
CHKT EXT
ESCA
OSCA
C092101E.ai
Figure SYS_SCANEXT
n Arguments
Table Arguments of SYS_SCANEXT
Re-warning interval when the scan period is being extended
automatically.
IN CHKT TIME No re-warning is made if 0 is specified.
The default re-warning interval when SYS_SCANEXT is not created
is 10 minutes.
Execution status of scan period automatic extension
EXT BOOL FALSE: Scan period is not extended.
TRUE: Scan period is extended.
OUT
ESCA TIME Actual scan period. (unit: ms)
The scan period of the application logic execution function specified
OSCA TIME
in the Link Architecture View of SCS Manager (unit: ms)
n Description
The SYS_SCANEXT function block checks execution status of the scan period automatic
extension.
If the scan period of the application logic execution function is extended longer than a certain
period of time (10 minutes by default), the condition is notified via diagnostic information
messages. The re-warning interval can be changed using the input parameter CHKT.
If the scan period automatic extension is enabled, ESCA outputs the actual scan period.
OSCA outputs the scan period of the application logic execution function specified in the
Resource Properties window of the Link Architecture View of SCS Manager.

<C9.21 SYS_SCANEXT (Scan Period Extension Indicator)> C9-52
n Remarks
later.

The scan period automatic extension function does not operate in the SCS simulator.
The scan period is fixed to 1 second regardless of the specification in the SENG in the case of
the SCS simulator. The table below shows the details of the input/output parameters.
Table Arguments of SYS_SCANEXT at SCS Simulation Tests
IN CHKT Invalid Invalid
EXT FALSE Output FALSE (no extension)
OUT ESCA 1000 Output a fixed value
OSCA 1000 Output a fixed value

The scan period automatic extension function does not work in the logic simulator.
Table Arguments of SYS_SCANEXT at Logic Simulation Tests
IN CHKT Invalid Invalid
EXT FALSE Output FALSE (no extension)
Output the scan period specified in the Resource
ESCA Defined value
OUT Properties window
Output the scan period specified in the Resource
OSCA Defined value
Properties window

<C10.1 SYS_SCAN (Execution Time Indicator)> C10-1
C10. Interference-free System Function

Blocks
This chapter explains interference-free system function blocks that cannot be used in
safety loops.
The Interference-free system function blocks are shown below.
Execution Time Indicator (SYS_SCAN)
SCS Clock Information (SYS_TIME)
Diagnostic Information Status Indicator (SYS_ALARM)
Control Bus Status Indicator (SYS_NETST)
ESB Bus Status Indicator (SYS_ESBINF)
Node Status Indicator (SYS_NODEINF)
IOM Status Indicator (SYS_IOMDSP)
Status Output for Subsystem Communication Module (SYS_ALRDSP)
Subsystem Communication Data Forcing Status Management (SYS_FORCE_SC)
Subsystem Communication Output Status Indicator (SYS_STAT_SC)
C10.1 SYS_SCAN (Execution Time Indicator)

A SYS_SCAN system function block outputs the execution time of application logic and
the ratio of CPU idling time.
SYS_SCAN
RST SCAN
ACT
AVE
MX
FREE
C100101E.ai
Figure SYS_SCAN
n Arguments
Table Arguments of SYS_SCAN
IN RST BOOL Reset switch (reset at change from FALSE to TRUE)
SCAN TIME Scan period (ms)
ACT TIME Actual operating time of application logic (ms)
OUT AVE TIME Average operating time of application logic (ms)
MX TIME Maximum operating time of application logic (ms)
FREE DINT Ratio of CPU idling time (%)

<C10.1 SYS_SCAN (Execution Time Indicator)> C10-2
n Description
The SYS_SCAN system function block outputs the operating time of an application logic and the
ratio of CPU idling time.
The scan period (SCAN) refers to the current scan period of the application logic execution
function of SCS.
The application logic operating time (ACT) is the time from reading to outputting of process data.
AVE is the average of ACT for 10 scans.
The ratio of CPU idling time (FREE) is the percentage of idling time, which is defined as 1 second
minus the sum of ACT and the processing time of the external communication function.
The SYS_SCAN system function block clears the maximum operating time of application logic
(MX) if it detects changes of the reset switch (RST) from FALSE to TRUE.
n Remarks
The SYS_SCAN system function block is an interference-free function block. Do not use it for
input to a safety loop.
The scan period (SCAN) refers to the current scan period of the application logic execution
function of SCS. If the scan period automatic extension is enabled, SYS_SCAN outputs the scan
period that is currently used in the SCS as a result of automatic extension instead of the scan
period specified in the Resource Properties window of SCS Manager. Use the SYS_SCANEXT
function block to acquire the scan period specified in the Resource Properties window in the
application logic.

Application logic operating time (ACT, AVE, MX) outputs the value equivalent to the 100% of the
Scan Period for Application Logic Execution Function.
CPU usage free time (FREE) always indicates 0%.

Scan operating time and CPU idling time are not measured because the value measured by a
PC is different from that of an SCS. Therefore, the input is invalid and all the outputs are fixed.
Table Arguments of the SYS_SCAN System Function Block at Logic Simulation Tests

IN RST Invalid Invalid. Not reset as the operating time is not measured.
SCAN Scan period Outputs the specified scan period (ms).
ACT 0 The operating time is always 0.
OUT AVE 0 The average operating time is always 0.
MX 0 The maximum operating time is always 0.
FREE 0 The ratio of CPU idling time is always 0.

<C10.2 SYS_TIME (SCS Clock Information)> C10-3
C10.2 SYS_TIME (SCS Clock Information)

The SYS_TIME system function block outputs the current time recognized by an SCS
according to Coordinate Universal Time (UTC).
SYS_TIME
YR
MO
DY
HR
MN
SC
C100201E.ai
Figure SYS_TIME
n Arguments
Table Arguments of SYS_TIME
YR DINT Current calendar year
MO DINT Current month (1 to 12)
DY DINT Current date (1 to 31)
OUT
HR DINT Current hour (0 to 23)
MN DINT Current minute (0 to 59)
SC DINT Current second (0 to 59)
n Description
The SYS_TIME is a system function block used to output the current time recognized by an SCS
according to Coordinate Universal Time (UTC).
n Remarks
The SYS_TIME system function block is an interference-free function block. Do not use it for

The time of the PC executing the SCS simulation test (UTC) is output.

The time of the PC executing the logic simulation test (UTC) is output.

<C10.3 SYS_ALARM (Diagnostic Information Status Indicator)> C10-4
C10.3 SYS_ALARM (Diagnostic Information

Status Indicator)
A SYS_ALARM system function block outputs the status of diagnostic information
message generation.
SYS_ALARM
SUM
CLS1
CLS2
CLS3
C100301E.ai
Figure SYS_ALARM
n Arguments
Table Arguments of SYS_ALARM
Logical OR of diagnostic information message generation status for alarm
SUM BOOL
classes 1 to 3
Diagnostic information message generation status of alarm class 1
CLS1 BOOL FALSE: No alarm has occurred
TRUE: At least one alarm has occurred
OUT Diagnostic information message generation status of alarm class 2
Diagnostic information message generation status of alarm class 3
n Description
The SYS_ALARM is a system function block used to detect diagnostic information message
generation status.
This system function block indicates the diagnostic information message generation status of
the entire SCS for each alarm class. If each output value is TRUE, it means that a diagnostic
information message of the corresponding alarm class has occurred.
These outputs are affected by operations in the Diagnostic Information window of an SENG. If
all diagnostic information messages of a given class are deleted from the Diagnostic Information
window of the SENG, the corresponding output value returns to FALSE.
n Remarks
The SYS_ALARM system function block is an interference-free function block. Do not use it for

<C10.3 SYS_ALARM (Diagnostic Information Status Indicator)> C10-5

The output parameters of the SYS_ALARM function block operate in the same way as in the
actual SCS.

All the outputs are always fixed to no alarm (FALSE).

<C10.4 SYS_NETST (Control Bus Status Indicator)> C10-6
C10.4 SYS_NETST (Control Bus Status Indicator)

A SYS_NETST system function block outputs control bus status and time
synchronization status.
SYS_NETST
BUS1
BUS2
TSYC
C100401E.ai
Figure SYS_NETST
n Arguments
Table Arguments of SYS_NETST
Status on the bus 1 side
BUS1 BOOL TRUE: Abnormal
FALSE: Normal
Status on the bus 2 side
BUS2 BOOL TRUE: Abnormal
OUT FALSE: Normal
Time synchronization status (only when connected to Vnet/IP, always FALSE
when connected to V net)
FALSE: Synchronized with external clock (synchronized to the SNTP server
TSYC BOOL
time)
TRUE: Synchronized with internal clock (not synchronized to the SNTP
server time)
n Description
A SYS_NETST system function block outputs the status of control buses to which a station is
connected and the time synchronization status of the station. Control buses used in ProSafe-RS
include V net and Vnet/IP. In the case of a station connected to V net, the time synchronization
status (TSYC) is always fixed to FALSE.
Meaning of Bus Status

BUS1 and BUS2 output the status of the communication paths of bus 1 and bus 2,
respectively, of the control buses to which a station is connected. They output TRUE when
the status is abnormal and FALSE when it is normal.
If the status of both BUS1 and BUS2 is abnormal (TRUE), it has the following different
meanings in the case of V net and Vnet/IP, respectively.
Table Difference in Meaning when BUS1 and BUS2 Output TRUE Due to Difference of Control Bus
Control bus Meaning of abnormal (TRUE)
Vnet/IP (*1) At least one error occurred in a Vnet/IP network system.
V net A bus within the domain in which the applicable station is included is abnormal.
*1: Errors occurring in all domains connected via Vnet/IP are displayed. Note that statuses of V net domains connected via V net
routers are not included.

For a station on Vnet/IP network, if the station cannot communicate with other stations,
both BUS1 and BUS2 will become TRUE to indicate the abnormality. In this condition,
TRUE is output to VNER of SYS_DIAG. If a single bus failure occurs while the local station
can still communicate with other stations, the output of the failed side, BUS1 or BUS2,
becomes TRUE. If the other bus fails as well after the occurrence of the first single failure (at
occurrence of multiple bus failures), the output for the latter bus that failed does not become
TRUE. If the bus that failed first recovers, the output regarding the status of the other bus
becomes TRUE.
Range Indicated by Bus Status

The target range within which a SYS_NETST system function block can detect bus statuses
varies depending on whether a station is connected to V net or Vnet/IP.
A Vnet/IP domain can be connected with other Vnet/IP domains via L3SWs. It can also be
connected to V net domains via V net routers. The figure below shows an example where
domains 1 to 3 are connected via Vnet/IP buses and domain 4 of V net bus is connected via a V
net router.
SENG SCSP HIS

(B)
First
BUS1 side Fault BUS1 side
L3SW L3SW
Vnet/IP Vnet/IP Vnet/IP
domain1 domain2 domain3
BUS2 side BUS2 side
L3SW L3SW Second
Fault
SCSP SCSP
(A) (C)
V net router
Scope of Vnet/IP network
SCSV V net SCSV

(X) domain4 (Y)
SCSP: SCS for Vnet/IP
SCSV: SCS for V net
L3SW: Layer 3 switch
C100402E.ai
Figure Example of Configuration of Multiple Domains
In the case of stations connected to V net (SCSV(X), SCSV(Y)), a SYS_NETST system function
block is able to detect bus statuses within the V net domain to which the station is connected
(domain 4 in the figure above).
In the case of an SCSP connected to Vnet/IP, on the other hand, a SYS_NETST system function
block is able to detect the representative bus status of the entire Vnet/IP network (domains 1,
2 and 3 above). The status of V net buses beyond V net routers (domain 4 in the figure above)
cannot be detected with the SCSPs SYS_NETST function block.
In case a SYS_NETST system function block is used in the application logic of SCSP (A), which
is connected to domain 1, if bus 1, which is connected to the SCSP of domain 2, fails, the output
value of BUS1 of the SYS_NETST system function block becomes TRUE (abnormal). Even if
bus 2, which is connected to domain 3, fails before bus 1 recovers from the failure, the output
value of BUS2 of the SYS_NETST system function block does not become TRUE. Once bus 1
recovers from the failure, the output value of BUS2 becomes TRUE.

Time Synchronization Mode
TSYC indicates the time synchronization mode of Vnet/IP. FALSE is always output in the
case of stations connected to V net.
Table Differences in Time Synchronization Mode (TSYC) by Control Bus Type

Control bus Time synchronization method TSYC output
FALSE: Synchronized with external clock
(synchronized to the SNTP server time)
Vnet/IP Synchronization with Vnet/IP time
TRUE: Synchronized with internal clock (not
synchronized to the SNTP server time)
Synchronization with V net time
V net Always outputs FALSE
IRIG-B time synchronization
n Remarks
The SYS_NETST system function block is an interference-free function block. Do not use it
for input to a safety loop.
R1.02.00 or later.
In the case of SCSPs connected to Vnet/IP, the output values of BUS1 and BUS2 of SYS_
NETST indicate the representative bus status. Even if it is judged that multiple bus failures
occurred based on the output result of SYS_NETST, communication may be possible in
some cases depending on the route to the communication destination.
In the case of SCSPs connected to Vnet/IP, if a bus failure on one side is detected by the
output of SYS_NETST, repair the failed location immediately.

All outputs are always fixed to FALSE.

All outputs are always fixed to FALSE.

<C10.5 SYS_ESBINF (ESB Bus Status Indicator)> C10-9
C10.5 SYS_ESBINF (ESB Bus Status Indicator)

A SYS_ESBINF system function block indicates the ESB bus status of a station.
SYS_ESBINF
NRL
NRR
C100501E.ai
Figure SYS_ESBINF
n Arguments
Table Arguments of SYS_ESBINF
Status of ESB bus on the left side (bus 1)
NRL BOOL TRUE: Normal status
OUT
Status of ESB bus on the right side (bus 2)
NRR BOOL TRUE: Normal status
n Description
A SYS_ESBINF system function block indicates the status of redundant ESB buses of a station
individually.
The ESB bus status can be detected for each side separately. NRL outputs the status of the ESB
bus (bus 1) on the left side and NRR outputs the status of the ESB bus (bus 2) on the right side.
When a SYS_ESBINF system function block indicates that one of the ESB buses is abnormal,
this means that the ESB buses on one side of all I/O nodes, except for CPU nodes, are
abnormal. The target I/O nodes include I/O nodes connected via optical ESB bus repeater
modules.
If the ESB bus status output parameters (NRL and NRR) are in conditions where communication
with at least one I/O node is possible via the ESB bus on the left or right side whichever is the
target, normal status (TRUE) is output. If they are unable to communicate with any I/O node,
abnormal status (FALSE) is output.
Note that FALSE is always output to NRL and NRR if no I/O node is defined within a station (in
case there is no node other than CPU nodes).
ESB bus errors occur in the following cases.

Failure of SEC402/SEC401 (ESB bus coupler module)
If all nodes below SEC402/SEC401 of the relevant bus become abnormal

<C10.5 SYS_ESBINF (ESB Bus Status Indicator)> C10-10
n Remarks
The SYS_ESBINF system function block is an interference-free function block. Do not use it
for input to a safety loop.
R1.02.00 or later.
A SYS_ESBINF system function block indicates normal if at least one node can
communicate via each ESB bus. For stations configured with optical ESB bus repeater
modules and when you need to know the error of a specific node for the following cases,
use the SYS_NODEINF system function block:
- Detect only ESB bus errors of a specific I/O node directly connected to SEC402/SEC401
without going through an optical ESB bus repeater module.
- Detect only ESB bus errors of a specific I/O node connected via optical ESB bus repeater
modules.
SEE
ALSO For more information about SYS_NODEINF, see the following:
C10.6, SYS_NODEINF (Node Status Indicator)

As long as any of the I/O nodes is defined, NRL and NRR will always output TRUE (normal).

A fixed value is output to all output parameters.
Table Arguments of SYS_ESBINF at Logic Simulation Tests
NRL BOOL Always outputs normal (TRUE)
OUT
NRR BOOL Always outputs normal (TRUE)

<C10.6 SYS_NODEINF (Node Status Indicator)> C10-11
C10.6 SYS_NODEINF (Node Status Indicator)

A SYS_NODEINF system function block indicates the status of communication with the
specified I/O node.
SYS_NODEINF
NODE NRL
NRR
C100601E.ai
Figure SYS_NODEINF
n Arguments
Table Arguments of SYS_NODEINF
IN NODE DINT Node number (2 to 14)
Status of communication with the specified node via the ESB bus on
the left side (bus 1)
NRL BOOL
TRUE: Normal status
OUT
Status of communication with the specified node via the ESB bus on
the right side (bus 2)
NRR BOOL
TRUE: Normal status
n Description
A SYS_NODEINF system function block indicates the status of communication with an I/O node
specified by a node number (NODE).
The SYS_NODEINF system function block outputs the status of communication with the
specified node via the left ESB bus (bus 1) to NRL and the status of communication with the
specified node via the right ESB bus (bus 2) to NRR, respectively.
The SYS_NODEINF function block outputs TRUE (normal status) if communication with the
specified I/O node is possible via the ESB bus indicated by the output parameter (NRL or NRR),
and FALSE (abnormal status) if communication is not possible.
Abnormal statuses are notified in the following cases.
In the case of failure of ESB bus interface module SSB401 of the specified node on the side
where an error is notified
In the case of failure of establishing a route to the specified node from the ESB bus on the
side where an error is notified (for instance, due to failures of SEC402/SEC401 as well as
failures of optical ESB bus repeater modules in the case of nodes connected via optical
ESB bus repeater modules).

<C10.6 SYS_NODEINF (Node Status Indicator)> C10-12
n Remarks
The SYS_NODEINF system function block is an interference-free function block. Do not use
it for input to a safety loop.
R1.02.00 or later.
NRL and NRR always return FALSE if a CPU node (node number 1) is specified.
NRL and NRR always return FALSE if a node number for which no node is defined is
specified.

As long as any of the I/O nodes is defined, NRL and NRR will always output TRUE (normal).

All input parameters of SYS_NODEINF are invalid and a fixed value is output for all output
parameters.
Table Arguments of SYS_NODEINF at Logic Simulation Tests
IN NODE Invalid The node number is invalid.
NRL BOOL Always outputs normal (TRUE).
OUT
NRR BOOL Always outputs normal (TRUE).

<C10.7 SYS_IOMDSP (IOM Status Indicator)> C10-13
C10.7 SYS_IOMDSP (IOM Status Indicator)

A SYS_IOMDSP system function block outputs the operating status of input/output
modules (AIO/DIO module or communication module).
SYS_IOMDSP
NODE RDY
SLOT CTL
C100701E.ai
Figure SYS_IOMDSP
n Arguments
Table Arguments of SYS_IOMDSP
IN
SLOT DINT Slot number (1 to 8)
Indicates whether or not the input/output module is normal.
RDY BOOL FALSE: Abnormal status
TRUE: Normal status
OUT Indicates whether or not the input/output module is on the control side
(*1).
CTL BOOL
FALSE: Standby side
TRUE: Control side
*1: Activated only when the module is in a dual-redundant configuration. If the module is defined as a non-redundant configuration in
I/O Wiring View, CTL will be always TRUE regardless of the module status.
n Description
The SYS_IOMDSP is a system function block used for outputting the operating statuses of input/
output modules.

<C10.7 SYS_IOMDSP (IOM Status Indicator)> C10-14
l Output
The output of RDY indicates whether or not the applicable input/output module is normal. If
the input/output module is normal, TRUE will be output.
The output of CTL indicates whether or not the input/output module is on the control side. It
outputs TRUE if the input/output module is on the control side.
In a dual-redundant configuration of AIO/DIO modules, if both modules failed, both CTL
signals respectively connected to the modules will become FALSE.
In a dual-redundant configuration of communication modules for subsystem communication,
if communication error or module error occurs, one of the module is holding the control right.
When error occurs on both modules, the CTL signal of the module that has held the control
right will be kept TRUE.
If no input/output module is present at the specified node number or slot number, FALSE will
be output to all outputs.
When node error (including the case that both ESB buses failed) occurs, RDY and CTL will
hold the previous values.
n Remarks
Use the SYS_DIAG system function block to detect all SCS diagnostic information including
input/output modules.
The SYS_IOMSDP system function block is an interference-free function block. Do not use it for

If the slot is assigned with an input/output module, RDY will always output TRUE (normal).
CTL indicates control or standby status of the module. The odd-numbered slot will show control
(TRUE) and the even-numbered slot will show standby (FALSE).

All inputs are invalid and all outputs are fixed. Regardless of the mounting position specified
in the SYS_IOMDSP system function block, an input/output module is always deemed to be
present in that position.
Table Arguments of the SYS_IOMDSP System Function Block at Logic Simulation Tests
IN
RDY TRUE Always indicates normal status (TRUE).
OUT
CTL TRUE Always indicates the control side (TRUE).

<C10.8 SYS_ALRDSP (Subsystem Communication Module Status Indicator)> C10-15
C10.8 SYS_ALRDSP (Subsystem Communication

Module Status Indicator)
A SYS_ALRDSP system function block outputs the status of subsystem communication
module.
SYS_ALRDSP
NODE MDS
SLOT P1S
P2S
C100801E.ai
Figure SYS_ALRDSP
n Arguments
Table Arguments of SYS_ALRDSP
IN
SLOT DINT Slot number (1 to 8)
Module status
MDS BOOL TRUE: No error
FALSE: Error (Faulty module)
Port 1 status
OUT P1S BOOL TRUE: No error
FALSE: Error (Communication error)
Port 2 status
P2S BOOL TRUE: No error
FALSE: Error (Communication error)
n Description
The SYS_ALRDSP is a system function block used for referencing the status of subsystem
communication module.
Occurrence of communication errors can be referenced for an entire module or for each port.
The status of the specified subsystem communication module is referenced regardless of
the redundant configuration of the module.
Errors in the communication with subsystems are detected regardless of the lock status of
subsystem communication data.
If no ALR111 or ALR121 subsystem communication module is present at the specified node
or slot, or when an ALR111 or ALR121 for Modbus slave communication is specified, all
outputs will become FALSE (error).
If the specified module is in an error state (MDS = FALSE), an error status will be output to
ports 1 and 2.
To use communication statuses in the application logic, the data statuses obtained by
function blocks that handle subsystem data, such as SCI_B and SCO_B, should be
referenced.
When node error (including the case that both ESB buses failed) occurs, MDS, P1S and
P2S will hold the previous values.

<C10.8 SYS_ALRDSP (Subsystem Communication Module Status Indicator)> C10-16
n Remarks
The SYS_ALRDSP system function block is an interference-free function block. Do not use
it to input data to safety loops.
R1.01.30 or later.

If the slot is assigned with a communication module, the communication module status (MDS),
port1 status (P1S) and port2 status (P2S) will always output TRUE (normal).

All inputs are invalid and all outputs are fixed. Regardless of the specified mounting position, a
communication module is always deemed to be present in that position.
Table Arguments of SYS_ALRDSP in Logic Simulation Tests
IN
MDS TRUE TRUE (No error) is always output.
OUT P1S TRUE TRUE (No error) is always output.
P2S TRUE TRUE (No error) is always output.

<C10.9 SYS_FORCE_SC (Subsystem Communication Data Forcing Status...)> C10-17
C10.9 SYS_FORCE_SC (Subsystem Communication

Data Forcing Status Management)
A SYS_FORCE_SC system function block manages the forcing status (lock status) of
SYS_FORCE_SC
UNLK LOCK
CHKT TUP
C100901E.ai
Figure SYS_FORCE_SC
n Arguments
Table Arguments of SYS_FORCE_SC
Forcibly unlocks all subsystem communication data.
UNLK BOOL FALSE TRUE: Forcibly unlock the data.
IN
The time during which to monitor the lock status of subsystem
CHKT TIME communication data.
Elapse of time is not checked if 0 is specified.
Presence of locked subsystem communication data
LOCK BOOL FALSE: None.
TRUE: At least one data item is locked.
OUT Indicates whether or not the time during which subsystem
communication data has remained locked exceeds the monitoring
TUP BOOL time (CHKT).
FALSE: CHKT is not exceeded.
TRUE: CHKT is exceeded.
n Description
The SYS_FORCE_SC is a system function block used for performing forcing management of
n Inputs
UNLK is an input that forcibly unlocks all subsystem communication data. If UNLK changes
from FALSE to TRUE, all subsystem communication data currently locked by the forcing
function will be forcibly unlocked. If you do not want all subsystem communication data to be
unlocked, set it to FALSE.
In CHKT, specify the time during which to monitor the lock status. If at least one subsystem
communication data remains locked beyond the monitoring time specified in CHKT,
a diagnostic information message will be generated to notify the user. This diagnostic
information message is generated every time the monitoring time specified in CHKT
elapses. Time is not monitored if CHKT is set to 0.

<C10.9 SYS_FORCE_SC (Subsystem Communication Data Forcing Status...)> C10-18
n Outputs
The output of LOCK indicates whether or not subsystem communication data is locked. If
any part of the subsystem communication data is locked, LOCK becomes TRUE.
The output of TUP indicates whether or not any subsystem communication data has
remained locked beyond the monitoring time specified in CHKT.
n Remarks
The SYS_FORCE_SC system function block is an interference-free function block. Do not
use it to input data to safety loops.
R1.01.30 or later.

Subsystem communication cannot be performed.
The lock status monitoring time (CHKT) on SCS simulator and on actual SCS may take different
time to reach time-up.

All inputs are invalid and outputs are fixed. Diagnostic information messages are not notified.
Table Arguments of SYS_FORCE_SC in Logic Simulation Test
UNLK Invalid Invalid. Data is not forcibly unlocked regardless of the input value.
IN
LOCK FALSE
OUT Output as no data is locked.
TUP FALSE

<C10.10 SYS_STAT_SC (Subsystem Communication Output Status Indicator)> C10-19
C10.10 SYS_STAT_SC (Subsystem

Communication Output Status Indicator)
A SYS_STAT_SC system function block manages the output enable status in subsystem
communication.
SYS_STAT_SC
RUN OTEN
C101001E.ai
Figure SYS_STAT_SC
n Arguments
Table Arguments of SYS_STAT_SC
Output enable operation in subsystem communication
FALSE TRUE: Perform the output enable operation in subsystem
IN RUN BOOL
communication.
Other: Nothing happens.
Output enable status in subsystem communication
OUT OTEN BOOL TRUE: Output is enabled.
n Description
The SYS_STAT_SC is a system function block used for managing the output status in subsystem
communication. The output enable operation is normally performed from the SENG. By using
a SYS_STAT_SC block, only the subsystem communication outputs can be enabled from the
application logic.
The output enable operation is performed when the input of RUN has changed from FALSE to
TRUE. If you dont want the output enable operation to be performed, set FALSE.
To enable safety outputs or outputs in inter-SCS safety communication, use the SYS_STAT
n Remarks
The SYS_STAT_SC system function block is an interference-free function block. Do not use
it to input data to safety loops.
R1.01.30 or later.

<C10.10 SYS_STAT_SC (Subsystem Communication Output Status Indicator)> C10-20

Subsystem communication cannot be performed.
The input/output parameters of the SYS_STAT_SC function block operate in the same way as in
the actual SCS.

Table Arguments of SYS_STAT_SC in Logic Simulation Tests
IN RUN Invalid Invalid
OUT OTEN TRUE TRUE is always output.

<D1. Integration with CENTUM> D1-1
D1. Integration with CENTUM

The main purposes of integrating with CENTUM are as follows.
To monitor the controlling status of SCS with an HIS
To notify errors on the field side to operators via process alarm messages
To set data to an SCS
To integrate system alarms
This chapter explains the SCS functions for integrating with CENTUM.
SEE
ALSO For CENTUM integration, see the following:
1. Overview of CENTUM Integration of the Integration with CENTUM VP/CS 3000 (IM 32S01E10-21E)
n Application Logics and CENTUM Elements

In the connection definitions for CENTUM integration, application logics and CENTUM elements
are associated in the manner shown in the table below. Since tag names are defined for
CENTUM elements, the user can monitor their statuses using the tag names.
Table Correspondence between Application Logics and Elements
Application logic CENTUM element

Internal variable (BOOL) %WB
Internal variable (DINT) %WB
Variable Internal variable (REAL) %WB
Input/output variable (IO_BOOL) %Z
Input/output variable (IO_REAL) %WB
Analog Input Function Block with Data Status
(ANLG_S), Analog Input FB (ANLGI)
Velocity limit alarm FB (VEL)
Override FBs
(OVR_B, OVR_I, OVR_R, OVR_IB and OVR_
IR) %BL
Grouping Override FB
(GOV_B, GOV_IB)
Function block Password FB (PASSWD)
Manual Operation FB (MOB_11, MOB_21,
MOB_RS, MOA)
External communication FBs
%WB
(ECW_B, ECW_I and ECW_R)
Subsystem Communication I/O FB
%WB
(SCI_B, SCI_I, SCI_R, SCO_B, SCO_I, SCO_R)
Annuciator FB (ANN) %AN

l Operation/Monitoring Using Tag Names
Operators can reference and set values of instances of application logics (function blocks defined
as entities) using tag names from an HIS. It is also possible to reference and set data from data
items of tag name.
l Process Alarm Message Transmission

CENTUM elements collect errors on the field side detected in an application logic and send
process alarm messages to an HIS. Process alarm messages include messages sent by
mapping blocks (%BL) and messages sent by annunciator elements (%AN).
A process alarm message is sent at the execution timing of a mapping block or annunciator
element. The occurrence/recovery time stamp attached to the messages is the time at which the
application logic is executed. If several messages are generated in one second from the same
block and element, only the last two event messages are sent.
n Software Inputs/Outputs
Two of the software inputs/outputs supported by FCSs, common switch and annunciator, are
available for use in SCSs.
Table Software Inputs and Outputs Available in SCSs
Name Support in SCS Element
Common Switches x %SW
Global switch %GS
Annunciator x %AN
Printout message (with printing, Historical) %PR
Printout message (without printing, Historical) %PR
Operation guide message %OG
Multimedia start message %VM
Sequence message request %RQ
Supervisory computer event message %CP
Supervisory computer message output for PICOT %M3
Signal event message %EV
SFC/SEBOL return event message output %RE
X: Supported
Blank: Not supported
TIP
The sent and received data through SCS Link Transmission cannot be accessed from HIS as accessing a %GS
element. For accessing from HIS, an internal variable should be placed in application logics. The examples below
show how to connect the internal variable with SCS Link Transmission FB, and then define the variable with a tag
name on the Tag Name builder.
For accessing the value of a sent data, the data connected to the sending FB should be branched so as to
connect to a variable.
For accessing the value of a received data, the output parameter of the receiving FB for the data value
should be connected with a variable.
For accessing the data status of a received data, the output parameter of the receiving FB for the data
status should be connected with a variable.

l Common Switches (Common Switches for System)
Since common switches for the system reflect the internal status of an SCS, they can be used in
the Graphic view of an HIS.
The table below lists common switches for the system. Elements without a switch number cannot
be used in SCSs. You cannot set a tag name or a value to SCS Common switches. You cannot
use the value of SCS Common switches in Application Logic, either.
Table Common Switches for System
Switch number Name Description
%SW0001 Initial cold start 1: Fixed (to initial cold start)
%SW0002 Continuous start 0: Fixed (to initial cold start)
%SW0004 (Reserved) Same as %SW0001
0: Normal
%SW0017 Right side CPU status
1: Abnormal
0: Normal
%SW0018 Left side CPU status
1: Abnormal
0: All fans are normal
%SW0019 CPU node fan status
1: At least one fan is abnormal
0: All CPUs are normal
%SW0020 CPU temperature status
1: At least one CPU is abnormal
0: Both modules are normal
%SW0021 CPU node power supply module status
1: Either the left or right module is abnormal
0: All nodes are normal
%SW0022 I/O node power supply module status
1: At least one node is abnormal
1: Control
%SW0027 Right side CPU control status
0: Other
1: Control
%SW0028 Left side CPU control status
0: Other
0: Normal
%SW0033 to 0042 Status of nodes 1 to 16 (*1)
1: Abnormal
%SW0065 to 0072 CPU idle time per minute (seconds) 0 to 60 seconds (8-bit integer)
%SW0073 to 0080 Communication load per second (%) 0 to 100% (8-bit integer)
0: Normal or no definition
%SW0097 to 0104 CPU node input/output module status
1: Abnormal
Status of input/output module (each of the
0: Normal or no definition
%SW0105 to 0176 8 slots) of the 2nd to the 10th nodes (I/O
1: Abnormal
nodes)
Status of input/output module (each of the
%SW0117 to 0208 0: Normal or no definition
8 slots) of the 11th to the 14th nodes (I/O
(*2) 1: Abnormal
nodes)
*1: 0 is set for undefined nodes.
*2: Applicable only for SCSP2.
l Update Interval
The SCS internal status is reflected in common switches for the system at the intervals of the
scan period of the external communication function.

n Plant Hierarchy
The mapping blocks and elements assigned with tag names can be handled as the equipment
objects in CENTUM plant hierarchies. By specifying the tag names of the SCS, the process
alarm filtering and security settings for operation and monitoring can be performed on HIS
according to the plant hierarchy definition.
SEE
ALSO For details of the plant hierarchy, see the following:
E10, Plant Hierarchy of CS 1000/CS 3000 Reference HIS (IM 33S01B30-01E)
E7, Plant Hierarchy of CENTUM VP Reference HIS (IM 33M01A30-40E)
For how to perform engineering tasks related to the plant hierarchy, see the following:
2.1.8, Plant Hierarchy of the Integration with CENTUM VP/CS 3000 (IM 32S01E10-21E)
l Relationship of SCS Tag Data and SCS with Plant Hierarchy

An SCS and the plant hierarchy have the following relationships.
It is possible to define upper level equipment names of an SCS at registering the SCS in
System View of CENTUM.
An equipment name which is defined in the CENTUM Plant Hierarchy Builder can be used
as the upper level equipment name of the mapping block or element.
Define the upper level equipment names when defining tag names of mapping blocks and
mapping elements in the Tag Name Builder of the SENG. The upper level equipment names
are managed as UAIDs (User Application IDs) within the SCS.
The UAID of mapping blocks/elements whose upper level equipment name is not defined in
the Tag Name Builder is set to 0 and the upper level equipment is set to the local SCS.
l Changing UAID
The upper level equipment names of mapping blocks and mapping elements can be
changed via online change download as well. UAIDs of mapping blocks and mapping
elements newly added via online change download take the values corresponding to the
upper level equipment names defined in the Tag Name Builder.
UAIDs managed by the SCS can be changed via operations from an HIS, SEBOL of FCS,
and OPC.
UAIDs cannot be changed from an SCSs application logic.

l Precautions when UAIDs are Changed from HIS and FCS
After changing UAID from HIS, FCS or OPC for the SCS tag name, if you perform the following
operations, the inconsistency of the UAID between HIS and SCS will occur.
Execute off-line download to the SCS
Reset and restart the SCS (when the SCS is reset and restarted, UAIDs of function blocks
take the values specified by the Tag Name Builder)
Reset and restart the HIS (when the HIS is reset and restarted, UAIDs of the tag list
maintained on the HIS take the values specified by the Tag Name Builder)
IMPORTANT
If UAIDs do not match between the HIS and SCS, the security management on the HIS and
process alarm filtering according to the plant hierarchy definitions no longer function correctly.
If UAIDs are set from an HIS, FCS or OPC, be sure to set the UAIDs again from the HIS, FCS or
OPC after SCS off-line download or resetting and restarting the HIS and/or SCS.

<D2. Tag Name Interfaces for CENTUM> D2-1
D2. Tag Name Interfaces for CENTUM

Mapping blocks and mapping elements are created when you define tag names for
function blocks and variables in an application logic in Tag Name Builder. They allow
accessing data using the tag names from an HIS and FCS.
n Overview of Mapping Blocks/Mapping Elements

In an CENTUM integration structure, mapping blocks/elements are created when users define
tag names in Tag Builder in an SENG.
Mapping blocks/elements map function blocks and variables of an application logic and provide
simple ways to interface with them via the tag names.
SENG
Engineering function
HIS
Tag Builder
tag names as interfaces

Data is accessed using
application
Download
V net
SCS
Application logic Mapping blocks/elements
Variable Variable Variable Mapping Mapping Mapping

Mapping by
element element element
the system
Mapping Mapping Mapping

FB FB FB
block block block
D020001E.ai
Figure Mapping Blocks/Elements
l Data Reference via Tag Name Interface

By defining tag names in Tag Builder, it is possible to associate mapping elements with
internal variables of BOOL, integer or real number type of an application logic and reference
the data using the tag names.
By defining tag names in Tag Builder, it is possible to associate mapping elements with
input/output variables of an application logic and reference the data using the tag names.
By defining tag names in Tag Builder, it is possible to associate mapping blocks/elements
with function blocks of an application logic and reference the data using the tag names.
For example, an ANLG_S function block can be associated with a mapping block, while an
ANN function block can be associated with a mapping element. Specific function blocks are
associated with mapping blocks.
SEE
ALSO For variables, elements and function blocks for which tag names can be defined, see the following:
List of Mapping Blocks/Mapping Elements in D2.1, Overview of Tag Name Interfaces

<D2.1 Overview of Tag Name Interfaces> D2-2
l Data Setting and Alarm Management by Tag Name Interfaces
Operations on mapping blocks/elements (without influencing application logics)
It is possible to acknowledge process alarms and set operation marks (data item OPMK).
If these operations are performed from an HIS, the data of the mapping blocks/elements
changes, but this does not cause any changes to variables and function blocks of
application logics.
Operations on variables and function blocks of an application logic
Operations on mapping blocks/elements are reflected in the corresponding application logic.
The override operations, setting BOOL-type data with password, setting data with Manual
Operation FB, setting data via tag name and so on operations can be performed.
l Input/Output Terminals
No input/output terminals are used for mapping blocks/elements of an SCS. Mapping blocks/
elements are used to exchange data with variables and function blocks of the corresponding
application block, and not for connection between with mapping blocks/elements.
D2.1 Overview of Tag Name Interfaces

In this chapter, the following items regarding tag name interface for CENTUM will be
explained.
Types of Mapping Blocks and Mapping Elements for the FBs and Variables
Data Size of Mapping Elements
Common Data Items of Mapping Blocks and Mapping Elements
Process Alarms
n List of Mapping Blocks/Mapping Elements

For keeping consistency with the data types of variables and the types of function blocks in the
application logics, the types of mapping blocks and mapping elements will be automatically
determined on Tag Name Builder according to the data types of variables and the types of
function blocks in the application logics.
The table below lists mapping blocks/elements.
Table Mapping Blocks/Elements (1/2)
Application logic definition Mapping block/element
Classification Description Type Type name/
Classification Type
name element name
BOOL type Internal variable BOOL Mapping element %WB
Internal
Integer-type (32-bit) Internal variable DINT Mapping element %WB
variable
Real number-type (32-bit) Internal variable REAL Mapping element %WB
Input/output Discrete I/O structure IO_BOOL Mapping element %Z
variable Analog I/O structure IO_REAL Mapping element %WB
Data setting (BOOL) FB ECW_B Mapping element %WB
Data setting from
Data setting (integer) FB ECW_I Mapping element %WB
external device
Data setting (real number) FB ECW_R Mapping element %WB
Analog input Analog input FB with data status FB ANLG_S Mapping block S_ANLG_S
indication Analog input FB ANLGI Mapping block S_ANLGI
Velocity limit Velocity limit alarm FB VEL Mapping block S_VEL
Annunciator FB ANN Mapping element %AN
Annunciator
First-up Alarm Annunciator FB ANN_FUP Mapping element %AN

Table Mapping Blocks/Elements (2/2)
Application logic definition Mapping block/element
Classifi-
Description Type Type name/
cation Classification Type
name element name
Override (BOOL) FB OVR_B Mapping block S_OVR_B
Override (integer) FB OVR_I Mapping block S_OVR_I
Override (real number) FB OVR_R Mapping block S_OVR_R
Override
Override (discrete) FB OVR_IB Mapping block S_OVR_IB
from HIS
Override (analog) FB OVR_IR Mapping block S_OVR_IR
Grouping override (BOOL) FB GOV_B Mapping block S_GOV_B
Grouping override (discrete) FB GOV_IB Mapping block S_GOV_IB
BOOL-Type data manual operation FB with
FB MOB_11 Mapping block S_MOB_11
two-position answerback
Manual BOOL-Type data manual operation FB with
FB MOB_21 Mapping block S_MOB_21
operation three-position answerback
Auto-reset BOOL-Type data manual operation FB MOB_RS Mapping block S_MOB_RS
Analog-Type data manual operation FB MOA Mapping block S_MOA
Password Password entry FB PASSWD Mapping block S_PASSWD
Subsystem communication input (BOOL) FB SCI_B Mapping element %WB
Subsystem communication input (integer) FB SCI_I Mapping element %WB
Subsystem Subsystem communication input (real number) FB SCI_R Mapping element %WB
communi- Subsystem communication output (BOOL) FB SCO_B Mapping element %WB
cation I/O
Subsystem communication output (integer) FB SCO_I Mapping element %WB
Subsystem communication output (real
FB SCO_R Mapping element %WB
number)
n Size of Memory Used by Communication Inputs/Outputs

The mapping elements corresponding to BOOL-type, DINT-type, REAL-type and IO_REAL-
type variables and ECW_B, ECW_I and ECW_R function blocks of an application logic are
communication inputs/outputs (%WB). The table below shows the maximum number of data
items that can be mapped and the size of memory used by communication inputs/outputs.
Table Size of Memory Used by Communication Inputs/Outputs
Maximum number of data
Description in application logic Mapping element Size of %WB used
items that can be mapped
BOOL-type variable %WB 1 bit
3200 data items in total
ECW_B FB %WB 1 bit
DINT-type variable %WB 2 words
REAL-type variable %WB 2 words
IO_REAL-type variable %WB 2 words 900 data items in total
ECW_I FB %WB 2 words
ECW_R FB %WB 2 words
SCI_B (FB) %WB 1 bit
SCI_I (FB) %WB 2 words
SCI_R (FB) %WB 2 words Up to 500 data items in total
regardless of the size of an
SCO_B (FB) %WB 1 bit FB (1 bit or 2 words)
SCO_I (FB) %WB 2 words
SCO_R (FB) %WB 2 words

n List of Data Items of Mapping Blocks/Mapping Elements

Each mapping block/mapping element has the following data items. See the explanation of each
mapping block/mapping element for a detailed explanation of each data item.
Table List of Data Items of Mapping Elements
FB External Subsystem Subsystem
Input/Output Annun-
Internal Variable Communication Communication Communication
Variable ciator
FB Input Output
Data IO_ IO_ ECW ECW ECW SCI SCI SCI SCO SCO SCO
BOOL DINT REAL ANN
Item BOOL REAL _B _I _R _B _I _R _B _I _R
ALRM x
AOFS x
PV x x x x x x
PVI32 x x (*1) (*1)
PVF32 x x x x x
PVI16 (*1) (*1)
PVU16 (*1) (*1)
OPMK x x x x x x x x x x x x x x x
UAID x
x: The data item exists.
*1: In the case of SCI_I/SCO_I, data items vary depending on the data type of communication inputs/outputs wired to function
blocks:
PVI32 if the data type is signed 32-bit integer, PVI16 for signed 16-bit integer and PVU16 for unsigned 16-bit integer

Table List of Data Items of Mapping Blocks for each FBs
FB
OVR_* GOV_*
ANLG_S ANLGI VEL MOB_11 MOB_21 MOB_RS MOA PASSWD
Data (*1) (*2)
Item
MODE x x x x x x x x x x
ALRM x x x x x x x x x x
AFLS x x x x x x x x x x
AF x x x x x x x x x x
AOFS x x x x x x x x x x
INV x x x x x x x
PV x x x x x x x x x
HH x x
PH x x
PL x x
LL x x
HYS x x x
OPMK x x x x x x x x x x
UAID x x x x x x x x x x
SH x x x x
SL x x x x
VL x
MV x x x x x x x
VAL x x
OUTV x x
SW x x x x x x
SHDN x x x
SS x x
MTM x x x
FV x
SDV x
MSH x
MSL x
MH x
ML x
GRNO x
x: The data item exists.
*1: Indicates OVR_B, OVR_I, OVR_R, OVR_IB or OVR_IR.
*2: Indicates GOV_B or GOV_IB.

n Data Items Common to Mapping Blocks/Mapping Elements

This section explains data items common to mapping blocks and mapping elements.
l AOFS (Alarm Inhibition)

AOFS is a data item indicating that the process alarm of the function block is inhibited.
This item is not displayed on the HIS tuning view along with the data items, however, the alarm
inhibition status can be identified by the color of the tag mark.
The data entry from HIS to this data item is possible. Using the button on the tuning view can
change the block into the alarm inhibition status.
The status is as follows:
Not Inhibit Alarm: 0 (Default)
Inhibit Alarm: 1
l OPMK (Operation Mark)

This data item indicates operation marks assigned to mapping blocks and mapping elements. It
is not displayed in the data item list of the HIS tuning view but operation marks can be assigned
using buttons in the tuning view. Data entry is also allowed.
Range
The range of OPMK is from 0 to 255.
Default
The default value of OPMK is 0.
l UAID (User Application ID)

This data item indicates UAIDs corresponding to the upper level equipment names in the plant
hierarchy, assigned to mapping blocks. It is not displayed in the data item list of the HIS tuning
view, but data entry is allowed.
The default value is the value specified in the Tag Name Builder.
l MODE (Block Mode)

MODE is a data item indicating the block mode.
Whether or not the block mode can be displayed on the HIS tuning view and instrument
faceplate, what kind of modes a block can have varies with the types of the mapping blocks.
The mode may change according to the parameter changes of the function block, but cannot be
changed from HIS.
The following modes are available:
O/S (Out of Service)
This is the initial status of a mapping block that all functionalities are not functioning. When
SCS is working in normal state, the mapping block will not work in this mode.
MAN (Manual)
This is a mode that the output can be manually manipulated.
IMAN (Initialization Manual)
This is a mode that the output is disabled.
This block mode exists together with other block mode.
AUT (Automatic)
This is a mode that the output of the function block is enabled.
The default mode of the function block is O/S(AUT), it means the function block is shifting from
O/S to AUT mode. (O/S(AUT) is a transition mode.)

l AFLS (Alarm Flashing Status)
This data item is not supported. Do not change the data of this item from CENTUM.
l AF (Alarm Detection)
This data item is not supported. Do not change the data of this item from CENTUM.
n Process Alarms
Process alarms notify process errors detected by the application logic as alarm messages for
CENTUM. Though the process alarms are sent by mapping blocks, when the process alarms
are displayed on HIS window to indicate abnormality or recovery events, the timestamps of the
events will be the reception time that HIS receives the alarms.
Each mapping block provides the following process alarms. Check the explanation of individual
function blocks associated with mapping blocks for details of process alarms.
Table Process Alarms Generated from Mapping Blocks
S_OVR_* S_GOV_* S_
S_ANLGI S_ANLG_S S_VEL S_MOB_21 S_MOB_11 S_MOB_RS S_MOA
(*1) (*2) PASSWD
NR x x x x x x x x x x
IOP x x x
OOP x x x
HTRP x x
LTRP x x
HHH x x
LLL x x
OVR x x
PWON x
PERR x
ANS+ x x x
ANS- x x x x
VEL+ x
VEL- x
x: The corresponding process alarm is generated.
Note: NR is the status set when other process alarms are not generated. Process alarms are displayed on an HIS in the order in the
table with the highest priority on the top item.
*1: Indicates S_OVR_B, S_OVR_I, S_OVR_R, S_OVR_IB or S_OVR_IR.
*2: Indicates S_GOV_B or S_GOV_IB.

<D2.2 Tag Name Interfaces for Internal Variables and Input/Output Variables> D2-8
D2.2 Tag Name Interfaces for Internal Variables

and Input/Output Variables
It is possible to define mapping elements for internal variables and input/output variables
to reference the data with tag name interfaces. If you define tag names using the Tag
Name Builder for BOOL, DINT or REAL-type internal variables, mapping elements are
created in the communication input/output (%WB) area.
If you define tag names for discrete input/output variables, they are associated with %Z
mapping elements. If you define tag names for analog input/output variables, they are
associated with %WB mapping elements.
n Data Items of Mapping Elements Associated with Internal Variables

All mapping elements of internal variables provide the OPMK data item.
SEE
ALSO For a detailed explanation of OPMK (operation mark), see the following:
Data Items Common to Mapping Blocks/Mapping Elements in D2.1, Overview of Tag Name Interfaces
l Data Items of Mapping Elements (%WB) Associated with BOOL-Type Variables

(PV)
Boolean values of BOOL-Type internal variables are displayed as PV. They are displayed in the
HIS tuning view and the parameter display area of instrument faceplate, and will be targets of
data collection for tuning trend. Data entry from an HIS is not allowed.
The range is 0 or 1.
l Data Items of Mapping Elements (%WB) Associated with DINT-Type Variable

(PVI32)
Integer values of DINT-Type internal variables are displayed as PVI32. They are displayed in the
HIS tuning view and the parameter display area of instrument faceplate. Data entry from an HIS
is not allowed.
The range is all signed 32-bit integers.
l Data Items of Mapping Elements (%WB) Associated with REAL-Type Variables

(PVF32)
Real values of REAL-Type internal variables are displayed as PVF32. They are displayed in the
HIS tuning view and the parameter display area of instrument faceplate. Data entry from an HIS
is not allowed.
The range is all single-precision real numbers.

n Data Items of Mapping Elements Associated with Input/Output

Variables
Mapping elements of input/output variables commonly support the OPMK data item.
SEE
l Data Items of Mapping Elements (%Z) Associated with IO_BOOL-Type

Variables (PV)
Discrete data values are displayed as PV. They are displayed in the HIS tuning view and the
parameter display area of instrument faceplate, and will be targets of data collection for tuning
trend. Data entry from an HIS is not allowed.
l Data Items of Mapping Elements (%WB) Associated with IO_REAL-Type

Variables (PVF32)
Analog data real values are displayed as PVF32. They are displayed in the HIS tuning view and
the parameter display area of instrument faceplate. Data entry from an HIS is not allowed.
The range is all single-precision real numbers.
n Data Access via Process Input/Output Terminal Numbers (%Z)

Process input/output terminal numbers (%Z) corresponding to IO_BOOL type input/output
variables are outlined below.
Discrete inputs and outputs are accessed not only via tag names but also process input/
output terminal numbers.
0 is obtained if data of input/output channels whose input/output variables are not wired is
referenced via process input/output terminal number.
l Specification Syntax
%Znnusmm
%Z: Process input/output identifier (fixed to %Z)
nn: Node number (01 to 14)
u: Slot number (1 to 8)
s: Segment number (fixed to 1)
mm: Terminal number (01 to 16)

n Data Items Used to Reference Data Status

The table below lists data items used to reference the data status of input/output variables using
tag name interfaces.
Table Referencing Data Status by Tag Names
Mapping Data item used for Data item used for data
Description
element data reference status reference
%Z Discrete (IO_BOOL type) inputs and outputs PV #PV (*1)
%WB Analog (IO_REAL type) inputs and outputs PVF32 #PVF32 (*1)
*1: The bit arrangement of the data status that can be referenced with #PV and #PVF32 is the same as the format used for FCS.
n Input/Output Status Information that can be Referenced from HIS and

FCS of CENTUM
The I/O status information, which is the basis of the data status of input/output variables, is stored
in the CPU. The status information is 32-bit data and structured in the same way as for an FCS.
This 32-bit data is transmitted when HISs and FCSs reference the status of inputs and outputs of
an SCS.
The data status of input/output variables is determined by whether or not the BAD status bit is on.
n Logical Data of Input/Output Variables

Data corresponding to an input/output variable consists of physical data and logical data.
Physical data is concrete data such as data input from sensors and data output to actuators.
Logical data is the data that can be referenced via an application logic.
SEE
ALSO For physical data and logical data, see the following:
A4.2, Input and Output Variables
The data read by tag name interfaces is logical data. The table below shows how to access data
via mapping elements associated with input/output variables.
Table Access to Logical Data of Input/Output Variables via Tag Names
Discrete Analog
Tag name defined for a discrete input/output
Tag name defined for an analog
Reading (logical data) variable (%Z)
input variable (%WB)
Process input/output terminal number (%Z)
Writing Not possible Not possible
Dictionary View of SCS Manager can display both physical data and logical data of input/output
variables.

n Conditions under which Tag Names can be Specified

The conditions under which it is allowed to define tag names and assign mapping elements for
input/output variables are explained in this section. Discrete input/output variables are of the
IO_BOOL type and analog input/output variables are of the IO_REAL type. Specify the Direction
attribute for these variables in Dictionary View of SCS Manager. There are three options for the
Direction attribute: Input, Output and Internal.
Specify the Input attribute for input variables. When the Input attribute is specified, the
variable can be connected to a channel of an input module in Wiring View.
Specify the Output attribute for output variables. When the Output attribute is specified, the
variable can be connected to a channel of an output module in Wiring View.
It is possible to define tag names for IO_BOOL-type and IO-REAL type variables in Tag Builder.
The table below shows whether or not tag names can be defined with the Direction attribute. Tag
names can be defined for variables with either the Input or Output attribute.
Table Direction Attribute of Variables and Tag Name Assignment
Direction
Input Output Internal
IO_REAL OK OK NG
IO_BOOL OK OK NG
OK: Tag name can be specified
NG: Tag name cannot be specified
: Not applicable

<D2.3 Tag Name Interfaces of Function Blocks> D2-12
D2.3 Tag Name Interfaces of Function Blocks

By specifying tag names for function blocks using the Tag Name Builder and associating
them with mapping blocks/mapping elements, it becomes possible to call them via the tag
names from CENTUM and notify process alarms.
This section explains mapping blocks and mapping elements of the following function
blocks.
Analog Input Function Blocks with Data Status (ANLG_S)
Analog Input Indication (ANLGI)
Velocity Limit Alarm (VEL)
Annunciator (ANN)
First-up Alarm Annuniciator (ANN_FUP) (*1)
Subsystem communication inputs/outputs (SCI_B, SCI_I, SCI_R, SCO_B, SCO_I,
SCO_R)
*1: Applicable only when integrated with CENTUM VP R4.02 or later.
SEE
ALSO See the following for tag name interfaces of other function blocks.
For override function blocks, see the following:
D3.2, Tag Name Interfaces and Process Alarms of Override Function Blocks
For more information about the Grouping Override FB, see the following:
D3.4, Tag Name Interfaces and Process Alarms of Grouping Override Function Block
For password function blocks, see the following:
D3.7, Tag Name Interfaces and Process Alarms of Password Function Blocks
For BOOL-type data manual operation function blocks with answerback, see the following:
D4.1.6, Tag Name Interfaces and Process Alarms of MOB_11 and MOB_21
For auto-reset BOOL-type data manual operation function blocks, see the following:
D4.2.2, Tag Name Interfaces and Process Alarms of MOB_RS
For analog-type data manual operation function blocks, see the following:
D4.3.2, Tag Name Interfaces and Process Alarms of MOA
For external communication function blocks, see the following:
D5.2, Tag Name Interfaces of External Communication Function Blocks

n Data Items of Mapping Blocks Associated with Analog Input Function

Blocks with Data Status (ANLG_S)
Mapping blocks associated with analog input function blocks with data status are S_ANLG_S.
Among the data items of mapping blocks, the data items unique to S_ANLG_S are explained
here. All of these data items are displayed in the HIS tuning view with the exception of MODE and
INV. Note that data entry for these data items from an HIS is not allowed.
SEE
ALSO For a detailed explanation on MODE (block mode), AFLS (alarm flashing status), AF (alarm detection
specification), AOFS (alarm inhibition specification), OPMK (operation mark) and UAID (user application ID), see
the following:
l MODE (Block Mode)

This data item indicates block mode.
The default value of MODE is O/S (AUT).
l ALRM (Alarm Status)

This data item indicates alarm status.
The default value of ALRM is NR.
l INV (Input Value)

This item is associated with the IN parameter (analog input) of ANLG_S.
Range
The range of INV is from 0 to 100%.
Default
The default value of IN (0%) of ANLG_S is reflected in the default value of INV.
l PV (Scale Conversion Value)

This data item is associated with the OUT parameter (analog output) of ANLG_S. It is displayed
in the parameter display area of instrument faceplate and will be a target of data collection for
tuning trend.
In the SCS databases created by R1.03.00 or later versions, the PV data are affixed with data
status signals. When the data status of IN signal of ANLG_S becomes BAD, the data status of
PV will be set as BAD. However, the data status only indicates BAD. IOP, NFP or other statuses
will be ignored.
TIP
To affix the data status, the item [PV Status of S_ANLG_S] on SCS tab of SCS Constants Builder needs to
be defined.
When the database is created, the PV data are affixed with data status signals at default setting. However,
if the above setting is not defined, when CENTUM station read the PV, even though the PV has data status
signal, the PV will be always marked as Normal regardless the actual data status.
In the SCS database created by R1.02, the PV of ANLG_S does not have data status signal.
Range
The range of engineering unit data after scale conversion
Default
The default value of SL (scale low limit) of ANLG_S is reflected in the default value of PV.

l HH (HI Trip Setting Level)
This data item is associated with the HH parameter (HI trip setting level) of ANLG_S. The HH
value of ANLG_S is reflected in this item.
l PH (HI Pre-Alarm Setting Level)

This data item is associated with the PH parameter (HI pre-alarm setting level) of ANLG_S. The
PH value of ANLG_S is reflected in this item.
l PL (LO Pre-Alarm Setting Level)

This data item is associated with the PL parameter (LO pre-alarm setting level) of ANLG_S. The
PL value of ANLG_S is reflected in this item.
l LL (LO Trip Setting Level)

This data item is associated with the LL parameter (LO trip setting level) of ANLG_S. The LL
value of ANLG_S is reflected in this item.
l HYS (Hysteresis)
This data item is associated with the HYS parameter (hysteresis) of ANLG_S. The HYS value of
ANLG_S is reflected in this item.
l SH (Scale High Limit)

This data item displays the scale high limit defined using the Tag Name Builder.
l SL (Scale Low Limit)

This data item displays the scale low limit defined using the Tag Name Builder.

n Data Items of Mapping Blocks Associated with Analog Input Function

Blocks (ANLGI)
Mapping blocks associated with analog input indication function blocks are S_ANLGI.
Among the data items of mapping blocks, the data items unique to S_ANLGI are explained here.
All of these data items are displayed in the HIS tuning view with the exception of MODE and INV.
Note that data entry for these data items from an HIS is not allowed.
SEE
the following:
l MODE (Block Mode)


l INV (Input Value)

This data item is associated with the IN parameter (analog input) of ANLGI.
Range
The range of INV is from 0 to 100%.
Default
The default value of IN (0%) of ANLGI is reflected in the default value of INV.
l PV (Scale Conversion Value)

This data item is associated with the OUT parameter (output value) of ANLGI. It is displayed
tuning trend.
Range
The range of engineering unit data after scale conversion
Default
The default value of SL (scale low limit) of ANLGI is reflected in the default value of PV.

l HH (High Trip Setting Level)
This data item is associated with the HH parameter (High trip setting level) of ANLGI. The HH
value of ANLGI is reflected in this item.
l PH (High Pre-Alarm Setting Level)

This data item is associated with the PH parameter (High pre-alarm setting level) of ANLGI. The
PH value of ANLGI is reflected in this item.
l PL (Low Pre-Alarm Setting Level)

This data item is associated with the PL parameter (Low pre-alarm setting level) of ANLGI. The
PL value of ANLGI is reflected in this item.
l LL (Low Trip Setting Level)

This data item is associated with the LL parameter (Low trip setting level) of ANLGI. The LL value
of ANLGI is reflected in this item.
l HYS (Hysteresis)
This data item is associated with the HYS parameter (hysteresis) of ANLGI. The HYS value of
ANLGI is reflected in this item.

This data item displays the scale high limit defined using the Tag Name Builder.

This data item displays the scale low limit defined using the Tag Name Builder.

n Data Items of Mapping Blocks Associated with Velocity Limit Alarm

Function Blocks (VEL)
Mapping blocks associated with velocity limit alarm function blocks are S_VEL.
Among the data items of mapping blocks, the data items unique to S_VEL are explained here. All
of these data items are displayed in the HIS tuning view with the exception of MODE. Note that
data entry for these data items from an HIS is not allowed.
SEE
the following:
l MODE (Block Mode)


l PV (Output Value)
This data item is associated with the OUT parameter (output value) of VEL. It is displayed in the
parameter display area of instrument faceplate and will be a target of data collection for tuning
trend.
Range
The range of PV is from 0 to 100%.
Default
The default value of PV is the SL (scale low limit) value, i.e., 0.0.
l VL (Velocity Limit Alarm Setting Value)

This data item is associated with the VL parameter (velocity limit alarm setting level) of VEL.
Default
The VL value of VEL is reflected in this item.
l HYS (Hysteresis)
This data item is associated with the HYS parameter (hysteresis) of VEL. The HYS value of VEL
is reflected in this item.

The value of this item is fixed to 100.0.

The value of this item is fixed to 0.0.

n Data Items of Mapping Elements Associated with Annunciator

Function Blocks (ANN)
Annunciator messages are message outputs that simulate behaviors of annunciator panels
of instrument faceplate on an HIS. When you create ANN function blocks for the application
logic, %AN mapping elements are created as well. By defining %AN messages in the Tag
Name Builder, annunciator messages can be checked from an HIS. Tag name definition is not
mandatory.
SEE
ALSO For a detailed explanation on AOFS (alarm inhibition specification), OPMK (operation mark) and UAID (user
application ID), see the following:

This data item indicates alarm status. It is displayed in the HIS tuning view but data entry from an
HIS is not allowed.
l PV (Input Value)
This data item is associated with the IN parameter (input value) of ANN. It is displayed in the HIS
tuning view and the parameter display area of instrument faceplate, and will be a target of data
collection for tuning trend. Data entry from an HIS is not allowed.
Range
The range of PV is 0 or 1.
Default
The default value of IN (0) of ANN is reflected for the default value of PV.
n Data Items of Mapping Elements Associated with First-up Alarm

Annunciator Function Blocks (ANN_FUP)
The first-up alarm annunciator function block has the function to identify the first signal that
shifts to the safe state within the same group. The annunciator message is output only when the
received signal is the first safe state signal in the group to which the function block belongs.
When you create ANN_FUP function blocks for the application logic, %AN mapping elements
are created as well. By defining %AN messages in the Tag Name Builder, annunciator messages
can be checked from an HIS (*1). Tag name definition is not mandatory.
Data items of this mapping block are exactly the same as the annunciator function block.
*1: Checking annunciator messages from HIS is supported only when integrated with CENTUM VP R4.02.

n Data Items of Mapping Elements Associated with Subsystem

Communication Inputs/Outputs
When you create tag names for SCI_B, SCI_I, SCI_R, SCO_B, SCO_I and SCO_R function
blocks in the Tag Name Builder, mapping elements are created in the communication input/
output (%WB) area. Among the data items of mapping elements, the data items unique to
subsystem communication inputs/outputs are explained here.
SEE
ALSO For a detailed explanation of the OPMK (operation mark) data item of subsystem communication inputs/outputs,
see the following:
l %WB Data Items Associated with SCI_B and SCO_B (PV: BOOL Data)
Mapping elements of SCI_B and SCO_B function blocks have PV (BOOL data) data items.
This data item displays BOOL-type data of the function blocks. It is displayed in the HIS tuning
view and the parameter display area of instrument faceplate, and will be a target of data
collection for tuning trend. Data entry from an HIS is not allowed.
l %WB Data Items Associated with SCI_I and SCO_I

In the case of SCI_I and SCO_I, data items of mapping elements vary depending on the data
type of communication inputs/outputs (%WB) wired to the function blocks.
Each data item displays integer data of the associated function block and is displayed in the HIS
tuning view and the parameter display area of instrument faceplate. Data entry from an HIS is not
allowed.
Data items for each data type of communication inputs/outputs are as follows.
PVI32 (Integer Data)
This data item is used when the data type of communication inputs/outputs wired to the
associated function block is signed 32-bit integer.
PVI16 (Integer Data)
associated function block is signed 16-bit integer.
PVU16 (Integer Data)
associated function block is unsigned 16-bit integer.
The range is all unsigned 16-bit integers.
l %WB Data Items Associated with SCI_R and SCO_R (PVF32: Real Number
Data)
Mapping elements of SCI_R and SCO_R function blocks have PVF32 (real number data) data
items.
This data item displays the real number data value of the associated function block. It is
displayed in the HIS tuning view and the parameter display area of instrument faceplate. Data
entry from an HIS is not allowed.
The range is all single precision real numbers.

<D3. Override Operation from HIS> D3-1
D3. Override Operation from HIS

The override operations can be carried out from an HIS to an SCS. To perform the override
operation, an override function block or grouping override function block is used. Using
grouping override function blocks allows you to manage these function blocks as a
group. This chapter explains the following points related to override operations from an
HIS.
Overview of override function blocks
Tag name interfaces and process alarms of override function blocks
Overview of grouping override function blocks
Tag name interfaces and process alarms of grouping override function blocks
Status management of function blocks used for override operations
Management of override using password function block
Tag name interfaces and process alarms of password function block
n Function Blocks Related to Override Operations

During the normal operation of SCS, the operation override is performed from an HIS to fix the
variable value to a predefined value that is different from the actual value.
The operation uses an override function block or grouping override function block, and is
permitted by hardware switch or the password function block.
The following function blocks are supported for override operation.
Table Function Blocks Related to Override Operations

Type of FB Name of FB Description
OVR_B BOOL-type data override
OVR_I Integer-type data override
Override FB OVR_R REAL-type data override
OVR_IB IO_BOOL-type data override
OVR_IR IO_REAL-type data override
GOV_B BOOL-type data grouping override
Grouping override FB
GOV_IB IO_BOOL-type data grouping override
Password FB PASSWD Password

<D3.1 Overview of Override FB> D3-2
D3.1 Overview of Override FB

To perform override to the data from HIS that is not required for group management, the
Override function block can be used. An override function block is provided for each data
type.
n Mechanism of Override Function Blocks

SEE
ALSO For the engineering tasks involved in override function blocks, see the following:
2.1.5, Engineering for Overriding from HIS of the Integration with CENTUM VP/CS 3000 (IM 32S01E10-
21E)
The following figure illustrates an example where an input variable is overridden using an
override function block for IO_BOOL-Type variable (OVR_IB). In the example of overriding
an input variable, the override function block is positioned immediately after the variable to be
overridden.
OVR_IB
IO_BOOL-Type variable IN OUT <IO_BOOL-Type data>
TRUE VAL STS

Override permission
(BOOL-Type variable) SW
D030101E.ai
Figure Example of Using OVR_IB Function Block for an Input Variable
In the normal status where the variable is not overridden, the OVR_IB function block outputs the
data input via input parameter IN as is from output parameter OUT. When an override operation
is specified from the HIS via the mapping block, the OVR_IB function block outputs the value
specified for input parameter VAL (TRUE in this case) from output parameter OUT. During
overriding, the data status of output parameter OUT is always TRUE (GOOD). If the override
operation is canceled from the HIS, the OVR_IB function block outputs the data input via input
parameter IN as is from output parameter OUT again.
A BOOL-Type variable is specified for input parameter SW of the OVR_IB function block. Under
normal circumstances, this BOOL-Type variable is set to be an input variable from a key switch.
If the user operates the key switch, the BOOL-Type variable value changes. If the BOOL-Type
variable becomes TRUE, input parameter SW of OVR_IB also becomes TRUE, and an override
operation is permitted. If the variable becomes FALSE, the override operation is prohibited.
Note that the override operation is not canceled even if input parameter SW changes from TRUE
to FALSE while the override instruction is active; output parameter OUT keeps on outputting the
value specified for input parameter VAL.
TIP
It is possible to change values of BOOL-Type variables by entering data along with the correct password from the
faceplate of an HIS by using the password function block. Utilizing this mechanism, it can be specified whether or
not to allow override operations using the password function instead of using hardware such as a key switch.
SEE
ALSO For the password function block, see the following:
C5.3, PASSWD (Password)

<D3.1 Overview of Override FB> D3-3
n Data Status of Input/Output Variables

OVR_IB and OVR_IR are override function blocks for IO_BOOL-Type variables and IO_REAL-
Type variables, respectively. These override function blocks fix the data status of output
parameter OUT of the associated variables to TRUE (GOOD), which is output when the variables
are placed in the override status.
The figure below illustrates a usage example of the override function block for IO_REAL-Type
variables. When the override status of the function block is activated via a mapping block from an
HIS, output parameter OUT outputs the following.
The data value of OUT (member v of structure IO_REAL) is set to the value input via input
parameter VAL, which is then output to the output side. The output is fixed to 20.0 in the
example of the figure below.
The data status of OUT (member status of structure IO_REAL) is fixed to TRUE (GOOD).
OVR_IR
IO_REAL-Type input variable IN OUT <IO_REAL-Type data>
20.0 VAL STS
Override permission
(BOOL-Type variable) SW
D030102E.ai
Figure Override of IO_REAL-type Variable
When the override operation of the function block is activated, the data status of output
parameter OUT is fixed to TRUE (GOOD) but the data status of input variables connected to
input parameter IN is not influenced. If the override function block is placed in the override status,
only output parameters OUT and STS change.

<D3.2 Tag Name Interfaces and Process Alarms of Override Function Blocks> D3-4

Override Function Blocks
To be able to perform override operations from an HIS using an override function block,
it is necessary to define the tag name in the Tag Name Builder and associate it with a
mapping block.
n Mapping Blocks Associated with Override Function Blocks

The table below shows mapping blocks associated with override function blocks.
Table Mapping Blocks Associated with Override Function Blocks
Override function block type Mapping block type
OVR_B S_OVR_B
OVR_I S_OVR_I
OVR_R S_OVR_R
OVR_IB S_OVR_IB
OVR_IR S_OVR_IR
SEE
ALSO For the procedure to define mapping blocks of override function blocks, see the following:
2.1.5, Engineering for Overriding from HIS of the Integration with CENTUM VP/CS 3000 (IM 32S01E10-
21E)
n Settings in Tag Name Builder

To be able to perform override operations from an HIS, it is necessary to make settings for
instances of override function blocks in the Tag Name Builder.
Use the Tag Name Builder to make specification for alarms during override operation and
answerback error alarms.
Alarms during override operation
Specify either [Yes] or [No].
The default is [Yes].
Answerback error alarms
Specify either [Both] or [No].
The default is [Both].
SEE
ALSO For a detailed explanation of items defined in the Tag Name Builder, see the following:
2.1.4, Definition of Tag Names of the Integration with CENTUM VP/CS 3000 (IM 32S01E10-21E)

n Data Items of Mapping Blocks Associated with Override Function

Blocks
Among the data items of mapping blocks, the data items unique to mapping blocks of override
function blocks are explained here. All of these data items are displayed in the HIS tuning view
with the exception of MODE. Note that data entry for these data items from an HIS is allowed
only for MV.
SEE
the following:
MODE (Block Mode)

ALRM (Alarm Status)

PV (Answerback Input Value)

This data item displays the override status and will be a target of data collection for tuning trend.
Associating parameters of the function blocks
The STS parameter (override status) of override function blocks is associated with PV.
Range
Correspondence between changes of the parameter value of override function blocks and
changes of PV
If STS of an override function block is TRUE, PV=1 and override operations from an HIS are
executed.
Default
The default value of STS (0) is reflected in the default value of PV.

MV (Manipulated Output Value)
Override operations are permitted if SW of an override function block is 1, and MV can be
manipulated from an HIS. This item will be a target of data collection for tuning trend.
Range
The range of MV is 0 or 1.
Default
The default value of MV is 0.
INV (Input Value)

This data item is associated with the IN parameter (input) of an override function block and is
displayed in the parameter display area of instrument faceplate. This value is output from OUT
when no override operation is performed. The IN value of an override function block is reflected
in this item.
VAL (Fixed Value)

This data item is associated with the VAL parameter (override value) of an override function block
and is displayed in the parameter display area of instrument faceplate. This value is output from
OUT when override operations are executed. The VAL value of an override function block is
reflected in this item.
OUTV (Output Value)

This data item is associated with the OUT parameter (output value) of an override function block
and is displayed in the parameter display area of instrument faceplate. The OUT value of an
override function block is reflected in this item.
SW (Switch)
This data item is associated with the SW parameter of an override function block. The range is 0
or 1. Override operations are permitted when the value of SW is 1. The SW value of an override
function block is reflected in this item.

n Process Alarm
Mapping blocks of the override function blocks generate two types of process alarms, override
ON and answerback error alarms. It can be specified in Tag Name Builder whether or not the
override function blocks should generate process alarms.
l Answerback Error Alarm

Answerback error alarms can be used to examine whether or not an override operation from an
HIS is functioning as instructed. A mapping block mediates the override operation between a
faceplate on the HIS side and an override function block.
HIS Control
bus Application logic
TAG0301 TAG0301
Internal
MV variable
MV PV BOOL
<BOOL data> IN OUT
variable
ON TRUE VAL
<BOOL data> SW
STS
OVR_B
MV PV PV
OFF Mapping
block
Faceplate
SCS
D030201E.ai
Figure Flow of Data between Override Function Block and Mapping Block
If you perform an override operation from the faceplate of the HIS, the mapping block stores
the value 1, which means instruct override, in its own data item MV. The data of MV is then
set to the internal variable of the override function block. The override function block examines
the validity of the set data. If the data is considered valid, the override function block goes into
override condition and changes the STS from FALSE to TRUE.
The mapping block reads the STS value of the override function block into the PV of the mapping
block at the next scan period.
The scan period of the mapping block is the same as the scan period of the external
communication function. The default value is 1 second.
If the value (MV) instructed by the mapping block and the status value (PV) read back from
the STS output of the override function block do not match, the mapping block generates an
answerback error alarm. If they match later, the mapping block recovers from the answerback
error alarm.
An answerback error alarm is generated under the following conditions.
ON side answerback error alarm (ANS+)
MV = 1 and PV 1
OFF side answerback error alarm (ANS-)
MV = 0 and PV 0
The mapping block recovers from an answerback error alarm under the following conditions.
ON side answerback error alarm (ANS+)
When PV changes to 1 or MV changes to a value other than 1
OFF side answerback error alarm (ANS-)
When PV changes to 0 or MV changes to a value other than 0

l Override ON Alarm
Override ON alarms can be used to notify an operator that the function block corresponding to
the tag name of an SCS is being overridden. A mapping block generates an override ON alarm
if an override function block is placed in the override status. Once the override instruction is
canceled, the system recovers from the override ON alarm.
An override ON alarm is generated under the following conditions.

PV = 1 (STS of the override function block is TRUE)
The system recovers from an override ON alarm under the following conditions.
PV = 0 (STS of the override function block is FALSE)

<D3.3 Overview of Grouping Override Function Block> D3-9
D3.3 Overview of Grouping Override Function

Block
When it is necessary to exclusively manage override operations from an HIS to multiple
data items, grouping override function blocks can be used.
Types of grouping override function block are shown below.
GOV_B: BOOL-type data grouping override
GOV_IB: IO_BOOL-type data grouping override
This section explains the following functions of grouping override function block. GOV_B
and GOV_IB differ only in the type of data they can handle. Their basic functions are
identical.
Group function
Override permit switch
Override enable status
Block mode
Override status cancel function
Data status for OUT parameter of GOV_IB function block
Operation of grouping override function block
n Group Function
By using a grouping override function block, it is possible to restrict the override operation of
multiple data items that are defined as a group to only one at a time. Multiple groups can be
defined within an SCS. The override operations can be performed simultaneously to grouping
override function blocks that belong to separate groups.
There are no limits to the number or types of grouping override function blocks that can be
defined as a group. Both GOV_B and GOV_IB can be included in a same group.
If the override operation is performed for a grouping override function block in a group, the
operation cannot be performed on other function blocks in the same group until it completes.
When the override operation is attempted simultaneously on another function block within
the same group, the override operation for that function block will be disabled.
It is also possible to enable the override operation for individual function blocks, without
grouping, using a grouping override function block.
l Group Number
Group number is defined for GRP. Multiple groups can be defined by assigning different group
numbers.
Up to 128 groups can be managed by a single SCS. Specify a group number (1 to 128) for
GRP.
When the group number is set to 0, that grouping override function block does not belong
to any group. The number limitation on simultaneous operations will be invalid, and the
override operation can be performed without being affected by the exclusive control on the
override operations for other grouping override function blocks.
The override operation cannot be performed if the group number is set to a negative number
or a number equal to or greater than 129.

n Override Permit Switch

The override operation can be performed from an HIS when the override permit switch (SW) is
set to TRUE (override allowed). When SW is set to FALSE (override prohibited), the override
operation cannot be performed from an HIS.
n Override Enable Status

Override Enable Status (ENS) indicates whether the override operation for a grouping override
function block is allowed.
When SW is set to TRUE (override allowed) and there are no other grouping override function
blocks for which override is being executed within the same group, ENS becomes TRUE
(override enable status), and the override operation can be performed.
However, if there is a function block for which override is being executed within the same group,
ENS of other function blocks in the group becomes FALSE (override disable status), and the
override operation cannot be performed.
If SW is set to FALSE (override prohibited), ENS will always be FALSE (override disable status).
TIP
When the group number is 0
When the group number is set to 0, if the override permit switch (SW) is TRUE, the override enable status
(ENS) is always TRUE. MODE indicated on the HIS instrument faceplate is MAN.
When the group number is negative, or 129 or greater
When a value outside the range is specified as the group number, the override enable status (ENS) is fixed
to FALSE regardless of the state of override permit switch (SW). The override operation is not allowed.
MODE indicated on the HIS instrument faceplate is always AUT.
n Block Mode
The override enable status can be checked from the block mode (MODE) by specifying the
tag name assigned to a grouping override function block and then calling the HIS instrument
faceplate. The block mode reflects the state of the function blocks override enable status
(ENS). MODE becomes MAN when ENS is TRUE, and AUT when FALSE.
The override operation is allowed only when MODE is MAN. When the override operation is
not permitted because the override permit switch (SW) is FALSE, or when override is being
executed for another function block in the same group, MODE indicates AUT.
n Override Status Cancel Function

Grouping override function blocks have the override status cancel function.
By changing from TRUE to FALSE the override permit switch (SW) of a grouping override
function block for which override is being executed, the override status will be canceled. At that
time, the override enable status (ENS) becomes FALSE.
TIP
The override status is canceled under the following conditions as well.
When a forced cancellation command is issued from the SYS_OVR block
When the group number is changed (The group number should be set to a fixed value. The online change
download during the override operation is prohibited.)

n Data Status for OUT Parameter of GOV_IB Function Block

During the override execution of GOV_IB function block, the data status of IO_BOOL-type output
(OUT) will be GOOD. When override is not being executed, the data status of input parameter IN
will be output as the data status of OUT.
During the override execution, if the override permit switch (SW) changes from TRUE to FALSE,
or if SYS_OVR issues a forced cancellation command, the override status will be canceled even
if IN data status is BAD.
n Operation of Grouping Override Function Blocks
l Execution of Override
Grouping override function block outputs the data input from IN as is from OUT when there is no
override execution.
1. Set the override permit switch (SW) to TRUE.
2. If there are no function blocks for which override is being executed within the group,
MODE of tag assigned to the function block becomes MAN, the override operation can be
performed. If the override operation is not allowed, MODE stays AUT.
3. If MV is set to 1 from the HIS instrument faceplate and PV of answerback signal changes to
1, data specified by VAL will be output from OUT of the grouping override function block. At
this time, the mode of other function blocks that belong to the same group will be AUT.
TIP
When the override operation is disabled, or when the override status is canceled by setting SW to FALSE, MV will
be reset to 0 and PV of answerback signal will be 0 as well.
l End of Override
When MV is set to 0 from an HIS and the override status is canceled, the data input from IN will
be output again from OUT of the grouping override function block. At this time, the mode of all
function blocks that belong to the same group becomes MAN (*1).
*1: Even if it belongs in the same group, the mode of the function block whose override permit switch (SW) is set to FALSE stays
AUT.

l Data Change during Override
The figure below shows the changes in each data when block A and block B that belong to the
same group are connected to the same override permit signal, and the override operation is
performed for block A.
Permit switch Block A override Block A override Block A override Permit switch
changed to TRUE execution cancellation execution changed to FALSE
OUT IN VAL IN VAL IN
Block A SW T
F
ENS T
F
MV (PV)
Mapping block A
MODE AUT MAN AUT
OUT IN
Block B SW T
F
T
ENS
F
Mapping block B MODE AUT MAN AUT MAN AUT
Block A is the function block for which override is executed, while block B is another
function block within the same group.
D030302E.ai
Figure State Transition of Blocks in the Same Group

<D3.4 Tag Name Interfaces and Process Alarms of Grouping Override Function Block> D3-13

Grouping Override Function Block
To perform the override operation from an HIS using the group function, it is necessary to
specify the tag name with Tag Name Builder and assign mapping blocks.
n Mapping Blocks Associated with Grouping Override Function Blocks

Mapping blocks associated with grouping override function blocks are shown in the table below.
Table Mapping Blocks Associated with Grouping Override Function Blocks

Override FB type Mapping block type
GOV_B S_GOV_B
GOV_IB S_GOV_IB
n Tag Name Builder Setting

When the override operation is performed from an HIS, set necessary items for the instance of
grouping override function block with Tag Name Builder.
The following item is set for Alarm in Overriding.
Alarm in Overriding
The default setting is [Yes].
SEE
ALSO For details regarding the items defined in Tag Name Builder, see the following:
2.1.4, Definition of Tag Names in the Integration with CENTUM VP/CS 3000 (IM 32S01E10-21E)
n Data Items of Mapping Blocks Associated with Grouping Override

Function Blocks
Among the data items of mapping blocks, the data items unique to mapping blocks associated
with grouping override function blocks are explained here. All of these data items are displayed in
the HIS tuning view. Data entry from an HIS is allowed for MV only.
SEE
the following:
n Data Items Common to Mapping Blocks/Mapping Elements in D2.1, Overview of Tag Name
Interfaces

l MODE (Block Mode)
This data item indicates block mode. It is possible to check whether the override operation can
be performed. MAN indicates the operation enable status, while AUT means the system prohibits
override execution and MV manipulation (executing/ending override) from an HIS is not allowed
in this case.
It is not possible to change the block mode to AUT or MAN from an HIS or FCS. The default value
of MODE is O/S (AUT). This is displayed in the parameter display area of instrument faceplate.
Associating parameter of the function blocks
The ENS parameter (override enable status) of grouping override function blocks is
associated with MODE.
Change in block mode (AUT/MAN)
If ENS is TRUE, the block mode is MAN; if FALSE, AUT.

l PV (Answerback Input Value)

This data item displays the override status and will be a target of data collection for tuning trend.
Associating parameter of the function blocks
The STS parameter (output status) of grouping override function blocks is associated with
PV.
Range
Correspondence between changes of the parameter value of grouping override function
blocks and changes of PV
If STS of a grouping override function block is TRUE, PV = 1 and override operations from
an HIS are executed.
Default
The default value of STS (0) is reflected in the default value of PV.
l MV (Manipulated Output Value)

Override operations are permitted if the block mode is MAN, and MV can be manipulated from an
HIS. This item will be a target of data collection for tuning trend.
Range
Default
l INV (Input Value)

This data item is associated with the IN parameter (input) of a grouping override function block
and is displayed in the parameter display area of instrument faceplate. This value is output from
OUT when no override operation is performed.
The IN value of a grouping override function block is reflected in this item.

l VAL (Fixed Value)
This data item is associated with the VAL parameter (fixed value) of a grouping override function
block and is displayed in the parameter display area of instrument faceplate. This value is output
from OUT when override operations are performed. The VAL value of a grouping override
l OUTV (Output Value)

This data item is associated with the OUT parameter (output value) of a grouping override
function block and is displayed in the parameter display area of instrument faceplate. The OUT
value of a grouping override function block is reflected in this item.
l SW (Switch)
This data item is associated with the SW parameter (override permit switch) of a grouping
override function block.
Range
The range of SW is 0 or 1. The SW value of a grouping override function block is reflected in
this item.
Operations by SW changes
Override operations are permitted only if the SW value is 1. However, the override operation
can actually be performed for the function block only when the MODE is MAN.
When SW changes from 1 to 0, the override status is canceled.
l GRNO (Group Number)

This data item is associated with the GRP parameter (group number) of a grouping override
function block. This item indicates the group number to which the function block belongs. If the
value is 0, the function block does not belong to any group. The GRP value of a grouping override
n Process Alarm
Override ON alarms are notified from grouping override function blocks.
l Override ON Alarm
Override ON alarms can be used to notify an operator that a function block is being overridden.
A mapping block generates an override ON alarm if an override function block is placed in the
override status. Once the override status is canceled, the mapping block recovers from the
override ON alarm.
An override ON alarm is generated under the following condition.
PV = 1 (STS of the override function block is 1)
The mapping block recovers from an override ON alarm under the following condition.
PV = 0 (STS of the override function block is 0)

<D3.5 Status Management of Function Blocks Used for Override> D3-16
D3.5 Status Management of Function Blocks

Used for Override
The SYS_OVR system function block can equally manage the statuses of override
function blocks and grouping override function blocks regardless of function block
types. In this section, override function blocks and grouping override function blocks are
collectively referred to as override function blocks.
SEE
ALSO For details of SYS_OVR, see the following:
C9.9, SYS_OVR (Override Function Blocks Management)
n Cancellation of All Override Statuses

The SYS_OVR function block can cancel the override statuses of all override function blocks in
an SCS at once.
When UNOV is changed from FALSE to TRUE, all override statuses are forcibly canceled and a
system alarm is generated.
It is possible to cancel all override statuses for a group of grouping override function blocks by
inputting the same permit switch to all function blocks within the group and setting the permit
switch to FALSE.
n Management of Override Enable Status

The SYS_OVR function block can manage the override enable statuses of all override function
blocks in an SCS.
The override enable status refers to the condition where the SW input parameter value of a
function block is TRUE.
The following types of management can be performed for override enable statuses of all override
function blocks within the SCS.
TIP
If there is a grouping override function block with a group number outside the specification range, the override
permission signal operation for that function block is considered a part of the override enable status management.
SWON
SWON indicates whether or not there is a function block in the override enable status.
NUMS
NUMS indicates the number of override function blocks in the override enable status.
For instance, if a common override permission signal is input to all the grouping override
function blocks that comprise a group of 10 function blocks, setting the override permission
signal to 1 makes NUMS to be 10.

<D3.5 Status Management of Function Blocks Used for Override> D3-17
SWC, NOVS
SWC is used to specify the maximum number of override function blocks that can be
simultaneously placed in the override enable status. NOVS indicates whether or not the
maximum number has been exceeded.
If TRUE is set for SW of more override function blocks than the number specified by SWC,
a system alarm is generated. However, it is possible to place override function blocks in the
override enable status even after the maximum number has been exceeded and the system
alarm has been generated.
In the case of grouping override function blocks, when a common permission signal is input
to all the function blocks within the group, the number of all function blocks that belong to
that group will be counted by SWC if the override permission signal is set to 1.
CKTS, TUPS
CKTS is used to specify the maximum duration of the status where at least one override
function block in the override enable status exists. TUPS indicates whether or not the status
has been continuing longer than the maximum duration.
If the status continues longer than the duration specified by CKTS, a system alarm is
generated.
n Management of the Override Status

The SYS_OVR function block can manage the override statuses of all override function blocks in
an SCS.
The override status refers to the condition where MV is set to 1 from an HIS by calling the
faceplate that corresponds to the tag name assigned to the function block, and the override
output value specified in VAL is being output from OUT of the function block.
OVR
OVR indicates whether or not there is an override function block in the override status.
NUMO
NUMO indicates the number of override function blocks in the override status.
For instance, when there are two groups (A and B) of grouping override function blocks, if a
function block in A is placed in the override status and a function block in B is also placed in
the override state simultaneously, NUMO becomes 2.
OVRC, NOVO
OVRC is used to specify the maximum number of override function blocks that can be
placed in the override status simultaneously. NOVO indicates whether or not the maximum
number has been exceeded.
If more function blocks than the number specified by OVRC are placed in the override
status, a system alarm is generated. However, it is possible to override even after the
maximum number has been exceeded and the system alarm has been generated.
For instance, when grouping override function blocks are used and OVRC is set to 2, if the
override operation is performed for the third group, a system alarm is generated.
CKTO, TUPO
CKTO is used to specify the maximum duration of the status where at least one override
function block in the override status exists. TUPO indicates whether or not the status has
been continuing longer than the maximum duration.
If the status continues longer than the duration specified by CKTO, a system alarm is
generated.

<D3.6 Permission for Override by Password FB> D3-18
D3.6 Permission for Override by Password FB

It is possible to use the password function block to set a BOOL variable of an application
logic to TRUE or FALSE from the faceplate of an HIS with password verification.
n Operation to Allow Override

In order to authenticate the override operations on override function blocks, a password block
can be used instead of using a hardware key switch. The permission can be granted or denied by
authenticating the password.
How to utilize the password function block for authenticating the override operations will be
explained below.
HIS SCS
CENTUM Application logic

Password FB
TAG0399
TAG0399 PASSWD BOOL variable
1
OUT OVRSW
With MV <Password> PSWD
MV PV password
ON
MV PV
PV
OFF
Mapping
Faceplate
block
Control
bus
Override FB
TAG0301 TAG0301
OVR_IB
MV Internal
variable
MV PV Input <IO_BOOL
IN OUT
ON variable data>
PV TRUE VAL
MV PV OVRSW SW STS
OFF
Mapping
Faceplate block
Override FB
TAG0303 TAG0303
OVR_IB
MV Internal
MV PV variable
Input <IO_BOOL
ON IN OUT
variable data>
PV TRUE VAL
MV PV
OVRSW SW STS
OFF
Mapping
Faceplate block
D030301E.ai
Figure Switching Override Permission Status by Password (Example)

The operation procedure of setting data with password verification in Figure, Switching Override
Permission Status by Password (Example) is shown below.
The default value of the output of the password function block is FALSE. The default status of the
faceplate is OFF for both MV and PV.
Start
Operations of HIS/SCS
User operation
from HIS
Set the switch of

faceplate A dialog box for entering
TAG0399 to ON the password appears
Enter the password

character string
A confirmation dialog box showing
<tag name> <comment> <label>
appears
Confirm the information in

the confirmation dialog box
MV of the faceplate
changes from OFF to ON
(PV remains OFF)
The validity of password entered

is checked by the mapping block
NO An error dialog box for

Is the password correct?
wrong password appears
YES
The soundness and correctness MV of the faceplate
of password character string changes from ON to OFF
entered is checked by the
password function block (*1)
The password function

blocks output value of the output
parameter OUT changes from
FALSE to TRUE
A system alarm notifying the

reception of data setting is
output from the password
function block (*2)
PV of the faceplate is turned ON
Perform the
override operation
D030602E.ai
*1: If there are any problems during checks by the password function block, the password function block outputs a system alarm that
includes a tag name and aborts the processing.
*2: System alarm messages include the password function block instance name and tag name.
Figure Permitting Override Operation by Password Function Block

When override operation is complete, operation of the override function block is prohibited in the
following manner.
End the
override operation
Operations of HIS/SCS
User operation
from HIS
Set the switch of

faceplate A dialog box for entering
TAG0399 to ON the password appears
Enter the password

character string
A confirmation dialog box showing
<tag name> <comment> <label>
appears
Confirm the information in

the confirmation dialog box
MV of the faceplate
changes from ON to OFF
(PV remains ON)
The validity of password entered

is checked by the mapping block
NO An error dialog box for

Is the password correct? wrong password appears
YES
The soundness and correctness MV of the faceplate
of password character string changes from OFF to ON
entered is checked by the
password function block (*1)
The password function

blocks output value of the output
parameter OUT changes from
TRUE to FALSE
A system alarm notifying the

reception of data setting is
output from the password
function block (*2)
PV of the faceplate is turned OFF
End
D030603E.ai
*1: If there are any problems during checks by the password function block, the password function block outputs a system alarm that
includes a tag name and aborts the processing.
*2: System alarm messages include the password function block instance name and tag name.
Figure Prohibiting Override Operation with Password Function Block

n Management of Password Function Block

The status of the PASSWD function block can be managed by a SYS_PSWD system function
block. The SYS_PSWD function block has the following functions.
The PASSWD function block is able to forcibly return the output from output parameter OUT
of all PASSWD function blocks within an SCS to FALSE. A system alarm is generated when
the SYS_PSWD function block is used for this purpose.
The SYS_PSWD function block displays whether or not there are any PASSWD function
blocks that output TRUE via output parameter OUT within an SCS. The number of such
PASSWD function blocks can also be displayed.
The SYS_PSWD function block generates a system alarm if the number of PASSWD
function blocks outputting TRUE from output parameter OUT exceeds the specified
maximum number. It is still possible to set more passwords even after the system alarm
indicating that the maximum number is exceeded has been generated, however.
The SYS_PSWD function block generates a system alarm if the status where there is one
or more PASSWD function blocks outputting TRUE continues longer than the specified
time.
SEE
ALSO For the detailed specifications about the SYS_PSWD system function block, see the following:
C9.10, SYS_PSWD (Password Function Blocks Management)

<D3.7 Tag Name Interfaces and Process Alarms of Password Function Blocks> D3-22

Password Function Blocks
In order to set values of a PASSWD function block from an HIS, it is necessary to define
the tag name using the Tag Name Builder and associate it with a mapping block. S_
PASSWD mapping blocks are associated with PASSWD function blocks.

Use the Tag Name Builder to make specification for password ON alarms and answerback error
alarms.
Password ON alarms
The default is [Yes].
SEE
ALSO For a detailed explanation of items defined in the Tag Name Builder, see the following:
2.1.4, Definition of Tag Names of the Integration with CENTUM VP/CS 3000 (IM 32S01E10-21E)
n Data Items of S_PASSWD

Among the data items of S_PASSWD, the data items unique to mapping blocks of S_PASSWD
are explained here. All of these data items are displayed in the HIS tuning view with the exception
of MODE. Note that data entry for these data items from an HIS is allowed only for MV.
SEE
the following:
MODE (Block Mode)

ALRM (Alarm Status)


<D3.7 Tag Name Interfaces and Process Alarms of Password Function Blocks> D3-23
This data item is associated with the OUT parameter of PASSWD. It is displayed in the parameter
display area of instrument faceplate and will be a target of data collection for tuning trend.
Range
Correspondence between changes of the parameter value of PASSWD and changes of PV
If the input password character string is correct, TRUE is output to OUT of PASSWD and PV
becomes 1.
Default
The default value of OUT (0) is reflected in the default value of PV.

Manipulate MV from an HIS to enter a password. It is displayed in the parameter display area of
instrument faceplate and will be a target of data collection for tuning trend.
Range
Default
n Process Alarms
The mapping block of PASSWD FB can initiate a process alarm for Password ON. It is possible
to specify whether or not to initiate this process alarms using the Tag Name Builder.
l Password ON Alarm
Password ON alarms can be used to notify an operator that the PASSWD function block is
currently outputting TRUE. A mapping block generates a password ON alarm if the PASSWD
function block outputs TRUE via output parameter OUT. The system recovers from the password
ON alarm if 0 is set with password from the faceplate.
A password ON alarm (PWON) is generated under the following conditions.
PV = 1 (OUT of the PASSWD function block is TRUE)
The system recovers from a password ON under the following conditions.

PV = 0 (OUT of the PASSWD function block is FALSE)

<D4. Manipulation of Manual Operation Function Blocks from HIS> D4-1
D4. Manipulation of Manual Operation

Function Blocks from HIS
Manual operation function blocks are used to output values manipulated by an operator
via an HIS to the application logic. Note that it is also possible to prohibit manipulation
from an HIS and set output values of function blocks with the application logic.
There are the following four types of manual operation function blocks.
MOB_11 (BOOL-Type Data Manual Operation Function Block with Two-Position
Answerback)
MOB_21 (BOOL-Type Data Manual Operation Function Block with Three-Position
Answerback)
MOB_RS (Auto-Reset BOOL-type Data Manual Operation)
MOA (Analog-Type Data Manual Operation)
SEE
ALSO See the following for each of the manual operation function blocks.
For a detailed explanation of MOB_11, see the followings:
C5.4, MOB_11 (BOOL-Type Data Manual Operation Function Block with Two-Position Answerback)
Answerback)
For a detailed explanation of MOB_21, see the followings:
C5.5, MOB_21 (BOOL-Type Data Manual Operation Function Block with Three-Position Answerback)
Answerback)
For a detailed explanation of MOB_RS, see the followings:
C5.6, MOB_RS (Auto-Reset BOOL-Type Data Manual Operation)
D4.2, HIS Interfaces of MOB_RS (Auto-Reset BOOL-Type Data Manual Operation)
For a detailed explanation of MOA, see the followings:
C5.7, MOA (Analog-Type Data Manual Operation)
D4.3, HIS Interfaces of MOA (Analog-Type Data Manual Operation)

<D4. Manipulation of Manual Operation Function Blocks from HIS> D4-2
n Overview of Manual Operation from HIS

For each of the four types of manual operation function blocks, parameter values of function
blocks can be changed by manual operations by an operator from an HIS. It is also possible to
specify whether or not to permit such manual operations with the application logic. If manual
operations are prohibited, output values can be changed from the application logic. Some
manual operation function blocks can also receive shutdown signals from the application logic,
forcing them to output shutdown signals.
All manual operation function blocks have functions to read back the results of manual
operations, so that the operator is able to check via HIS instrument faceplate that operation
instructions are correctly received. These function blocks are safety function blocks. There is no
need for users to take safety measures as in the case of external communication function blocks.
HIS SCS
Manual operation Integration with Application Logic

block CENTUM
function
Manual Manual
TAG0399 Operation TAG0399
Operation
Click
Output
<Shutdown signal> SHDN OUT
variable
MV PV MV
MV=2 <Manual operation
Output of ON ON SW
permission signal>
Open side OFF
Motor
MV=0 MV PV valve
PV <Answerback signal> AIN
Click OFF
<Password string> PSWD
Control Mapping
Instrument
bus block
faceplate
(I/O parameters are partially
omitted in this figure)
D040001Eai
Figure Overview of Manual Operation from HIS

<D4.1 HIS Interfaces of MOB_11 and MOB_21 (BOOL-Type Data...> D4-3
D4.1 HIS Interfaces of MOB_11 and MOB_21

(BOOL-Type Data Manual Operation
Function Block with Answerback)
BOOL-type data manual operation function blocks with answerback have 1 or 2 DI inputs,
which are typically used to connect the answerback input from a limit switch, and 1 DO
output, which is typically connected to a valve. In addition to manipulation of the output
value from an HIS, it is possible to set the output value from the application logic.
BOOL-type data manual operation function blocks with answerback also have a
parameter for receiving shutdown events; they can output shutdown logic signals with
the highest priority at occurrence of shutdown events.
This section explains the following functions of MOB_11 and MOB_21.
Manual operation permission function
Password at manual operations
Output enable status display function
Answerback check
IOP/OOP monitoring
SEE
ALSO See the following for other functions of MOB_11 and MOB_21.
For an explanation of parameters of MOB_11, see the following:
C5.4, MOB_11 (BOOL-Type Data Manual Operation Function Block with Two-Position Answerback)
For an explanation of parameters of MOB_21, see the following:
C5.5, MOB_21 (BOOL-Type Data Manual Operation Function Block with Three-Position Answerback)
n Types of BOOL-Type Data Manual Operation Function Blocks with

Answerback
There are two types of BOOL-type data manual operation function blocks with answerback,
which are distinguished by the number of answerback inputs.
MOB_11 (BOOL-Type Data Manual Operation Function Block with Two-Position
Answerback)
This type corresponds to SIO-11 function block of FCS and receives answerback input from
either one of the limit switches, open or close.
MOB_21 (BOOL-Type Data Manual Operation Function Block with Three-Position
Answerback)
This type is also corresponds to SIO-21 function block of FCS and receives answerback
input from both limit switches, open and close.
SEE
ALSO For detailed explanation of FCS switch instruments, see the following:
D3.4, Switch Instrument Block and Enhanced Switch Instrument Block of the CS 1000/CS 3000
Reference Function Block Details (IM 33S01B30-01E)
D3.4, Switch Instrument Block and Enhanced Switch Instrument Block of the CENTUM VP Reference
Function Block Details (IM 33M01A30-40E)

n Example of Configuration of MOB_11 and MOB_21

The figure below shows a usage example of MOB_11 in a CENTUM integration structure.
MAN
NR
CENTUM
MODE
SCS
ALRM
MV
PV
Shutdown logic SHDN
FALSE SS
OUT Output logic
Output logic in AUT mode IN
Manual operation SW
permission logic
LIMSW_OPEN AIN
NANP
T#5000ms MTM
NANM
AIN_DSTS IOP
OUT_DSTS OOP
OUT_Enabled OTEN
'password' PSWD
D040101E.ai
Figure Usage Example of BOOL-Type Data Manual Operation Function Block with Two-Position
Answerback

The figure below shows a usage example of MOB_21 in a CENTUM integration structure.
MAN
NR
CENTUM
MODE
SCS
ALRM
MV
PV
Shutdown logic SHDN
FALSE SS
OUT Output logic
Manual operation SW
permission logic
LIMSW_OPEN AINP
LIMSW_CLS AINM
NANP
T#5000ms MTM
NANM
AIN_DSTS IOP
NPER
OUT_DSTS OOP
OUT_Enabled OTEN
'password' PSWD
D040102E.ai
Figure Usage Example of BOOL-Type Data Manual Operation Function Block with Three-Position
Answerback
The associated parameter values of SCS function blocks are sent to indicate the block mode
(MODE), process alarms (ALRM) and answerback input values (PV) on the CENTUM side
via mapping blocks. The value of OUT is displayed as MV on HIS instrument faceplate and
operations on MV from the HIS are sent to OUT of the SCS in the manual mode (MAN).

n Overview of Processing BOOL-Type Data Manual Operation Function

Block with Answerback
The figure below shows an overview of the processing of BOOL-Type data manual operation
function blocks with answerback in SCS and data flow.
HIS
BOOL-Type data manual operation block with answerback

Display current data of OUT
Flow of control
Display actual field value
SHDN Flow of data

Manual operation
SS
SHDN equal to SS
OUT
SW
SHDN not equal to SS
IN
SW equal to FALSE
Value from SW equal to TRUE

HIS (MV)
This variable always follows the value of OUT
except when the data from HIS is received.
Comparison AIN
AIN
with OUT
Answerback input
Limit swich
D040103E.ai
Figure Flow of Control and Data (Example of MOB_11)
Shutdown Processing
If the input value of SHDN (shutdown signal) matches the safe state specified by the input value
of SS, the safe state is output from OUT. At this point, all data settings from input parameters
other than SHDN and SS as well as an HIS are ignored.
Prohibition of Manual Operations

If the input value of SHDN does not match the safe state specified by the input value of SS and
the manual operation permit switch SW is set to FALSE (manual operations prohibited), data
input to IN is output to OUT as is. If an operator attempts to perform manual operations from an
HIS when the input to SW is FALSE, the attempt will fail. IN can be used to change the output
value of OUT from the application logic when no shutdown instruction is input from SHDN (i.e.,
when the system is in a safe state).
For example, after the value of SHDN becomes FALSE in the DTS logic and the valve closes,
FALSE should be input to SW and the IN value kept as FALSE. In this way, it is possible to
prevent the valve from opening immediately when the value of SHDN becomes TRUE as the
shutdown conditions are removed.

Permission of Manual Operations
If the input value of SHDN does not match the safe state specified by the input value of SS and
SW is set to TRUE (manual operations permitted), the result of manual operations carried out
by an operator from an HIS is output from OUT. Note that password entry is required to perform
manual operations. The password is checked within a function block. If the passwords do not
match, the value of OUT does not change. The status where manual operations are permitted
can be used when it is desired to open/close a valve by a user operation without issuing a
shutdown instruction from SHDN (i.e., the system is in a safe state).
Answerback Check
Regardless of whether the input to SW is TRUE or FALSE, it is checked whether the OUT value
and answerback input value match as an answerback input check.
For example, by connecting OUT to the output signal to a valve and the answerback input value
(AIN for MOB_11) to the limit switch of the valve, it is possible to confirm that the output result
of OUT is correctly transmitted to the process. It is also possible to bypass the answerback
input value check for a fixed period of time only after changing the value of OUT, taking into
consideration the time that the valve requires to change from full open to full close.
SEE
ALSO See the following for the examples of using MOB_11 and MOB_21.
3.3.5, Example of using Bool-type Data Manual Operation Function Block (MOB_*) of the Engineering
Guide (IM 32S01C10-21E)

D4.1.1 Manual Operation Permission Function

With MOB_11 and MOB_21, it is possible to switch between whether or not manual
operations from an HIS are permitted. If MV is manipulated from an HIS when manual
operations are permitted, the output from OUT of function blocks is set accordingly.
Prohibition of manual operations can be used to prevent operations from an HIS at
occurrence of demands other than shutdown to output a value determined by the
application logic.
n Switching Between Whether or not Manual Operations are Permitted

In MOB_11 and MOB_21, it is possible to specify whether or not manual operations are
permitted. When shutdown events occur, however, the shutdown processing takes the priority,
and outputs set by manual operations as explained in this section and outputs from the
application logic connected to IN become invalid.
The following parameters are related to specification of whether or not manual operations are
permitted in MOB_11 and MOB_21.
MOB_11
IN
OUT
SW
D040104E.ai
Note: Other parameters are omitted.

Figure Parameters Related to Manual Operations
Overview of Manual Operations

SW is TRUE: The value set by a manual operation from an HIS to this FB is output from
OUT.
SW is FALSE: The value input to IN is output from OUT.
Details of Manual Operations

If the input value of SW is TRUE, manual operations from an HIS are permitted. This
status is called manual mode and MAN is displayed for the block mode in HIS instrument
faceplate. The value of OUT changes according to the changes of MV which is manipulated
from an HIS (for example, from a instrument faceplate). The value of IN is not used.
If the input value of SW is FALSE, manual operations from an HIS are not allowed. The
value determined by the application logic and input to IN of a function block is output from
OUT. If the value of OUT changes due to a change in the input to IN, the associated MV
value on the CENTUM side also changes accordingly. This status is called automatic mode
and AUT is displayed for the block mode in HIS instrument faceplate.

D4.1.2 Password at Manual Operations

It is possible to prompt users to enter passwords for the purpose of limiting the member
of users that are able to manipulate function blocks via manual operations from an HIS.
n Password Processing
The following parameters are related to password entry when manual operations are permitted.
MOB_11
SW
OUT
PSWD
D040105E.ai

Figure Parameters Related to Password Entry when Manual Operations are Permitted
Overview
Set a password in PSWD when you create POU.
If the input to SW is TRUE, manual operations from an HIS are permitted and entry of a
password is required when an operator enters a value for MV. Manipulations of MV are
permitted only if the set password and the input password match.
Setting Password Character String

A password for allowing MV manipulations from an HIS should be set in PSWD in advance. Set
PSWD as specified below.
Specify a password character string as a character constant.
A character string of up to 16 single-byte alphanumeric characters can be set. If you specify
a character string exceeding 16 characters, only the first 16 characters are set as the
password character string and the remaining part is ignored.
It is recommended to specify a password character string for each instance of the function
blocks that require passwords (PASSWD, MOB_21, MOB_11 and MOA) and be sure each
password is unique within a system.
If it is not necessary to restrict MV manipulations via password entry, specify an empty
character string for PSWD. In this case, an operator can simply press the return key in the
password input dialog box displayed in an HIS before manipulating MV.
Operation in HIS
If the input to SW is TRUE, i.e., the system is in the manual mode (MAN), a user is allowed to
perform manual operations from an HIS. In this case, the user is required to enter a password.
The entered password is checked within the SCS function block. If the password is incorrect, a
warning message for the illegal operation will be displayed and the MV will be unchanged.
If a communication error with an HIS occurs during manual operations, OUT retains the current
value.

D4.1.3 Output Enable Status Display Function

It is possible to display the output enable status in the instrument faceplate.
n Output Enable Status Display

The following parameters are related to output enable status display of MOB_11 and MOB_21.
MOB_11
OTEN
OUT
D040106E.ai

Figure Parameters Related to Output Enable Status Display
Overview of Output Enable Status Display

If a signal indicating output enable status is input to OTEN, the output enable status is displayed
in HIS instrument faceplate as block mode. If the value of OTEN is FALSE, IMAN is displayed as
block mode.
Details of Output Enable Status Display

Acquire the output status associated with a channel connected to OUT using an SYS_OUTEN
function block, and then connect it to OTEN.
The value of OTEN does not affect output behaviors or answerback check operations of MOB_11
and MOB_21.

D4.1.4 Answerback Check Function

The operation of answerback check is different for MOB_11 and MOB_21.
n Answerback Check of MOB_11

The following parameters are related to answerback check of MOB_11.
MOB_11
AIN
OUT
MTM
NANP
NANM
D040107E.ai

Figure Parameters Related to Answerback Check of MOB_11
The table below explains the parameters.

Table Explanation of Parameters Related to Answerback Check
IN AIN BOOL Answerback input value
TRUE: Open status
FALSE: Close status
MTM TIME Answerback check mask time
OUT OUT BOOL Open/close operation output value
TRUE: Open instruction
NANP BOOL Answerback status of the open side
TRUE: Normal status
NANM BOOL Answerback status of the close side
TRUE: Normal status

Details of Answerback Processing for MOB_11
Answerback Check Operation
In an answerback check operation, the answerback input value (AIN) is compared with the
OUT value to see if they are the same. The check result is output from NANP (answerback
status of the open side) and NANM (answerback status of the close side) of a function block
as well as notified to an HIS as a process alarm (ANS+ and ANS-) on the CENTUM side.
Note that detection of answerback errors does not influence the output behavior of OUT.
Answerback Check Mask
In practice, it takes some time for operations to be completed after changing the value of
OUT. For this reason, MOB_11 is equipped with MTM (answerback check mask time). By
setting this parameter, it is possible to prevent errors from being notified for a fixed time
specified by MTM after OUT is changed, even if the value of OUT and the answerback input
value are different. After the value of OUT is changed, if the answerback input status is still
abnormal after the time specified by MTM has elapsed, answerback errors on the open and
close sides are output to NANP and NANM, respectively.
Timing to Perform Answerback Check Processing
The answerback check and answerback check mask processing can be performed either
while a shutdown instruction is being output, application logic signals are being output
because the input to SW is FALSE, or manual operations from an HIS are performed
because the input to SW is TRUE.
Relationship between Answerback Check and Parameters

The figure below shows how each parameter changes due to answerback check processing.
Open Close Open Close
T
OUT
F
T
AIN
F
Mask MTM
Timer 0
T
NANP
F
T
NANM
F
D040108E.ai
Figure Detection of Answerback Errors in MOB_11
When OUT changes, the mask timer for answerback check will be started. The mask for
answerback check will continue until the time specified by MTM has elapsed. Within this
masked time period, the answerback error will be ignored.
Immediately after the value of OUT is changed, TRUE (normal) is set to NANP and NANM
once. Process alarms of answerback errors are also canceled once.

n Answerback Check for MOB_21

The following parameters are related to answerback check for MOB_21.
MOB_21
AINM
OUT
AINP
NANP
MTM
NANM
NPER
D040109E.ai

Figure Parameters Related to Answerback Check of MOB_21

IN AINP BOOL Answerback input value on the open side
TRUE: Full open status
FALSE: Not full-open status
AINM BOOL Answerback input value on the close side
TRUE: Full close status
FALSE: Not full-close status
OUT OUT BOOL Open/close operation output value
TRUE: Open instruction
NANP BOOL Answerback status of the open side
TRUE: Normal status
NANM BOOL Answerback status of the close side
TRUE: Normal status
NPER BOOL Answerback pattern
TRUE: Normal status

Details of Answerback Processing of MOB_21
Answerback Check Operation
In the case of MOB_21, the input values of both AINP (answerback input value of the open
side) and AINM (answerback input value of the close side) are compared with the value of
OUT to see if they are the same in the answerback check processing. The check result is
output from NANP (answerback status of the open side) and NANM (answerback status of
the close side) of a function block as well as notified to an HIS as a process alarm (ANS+ or
ANS-) on the CENTUM side.
MOB_21 checks answerback pattern errors as well. Answerback pattern errors refer to an
abnormal status where a full open signal and a full close signal are input at the same time.
If a status where AINP (answerback input value of the open side) is TRUE (full open status)
and AINM (answerback input value of the close side) is also TRUE (full close status) occurs,
FALSE (abnormal status) is output from NPER (answerback pattern) and is also notified to
the HIS as a process alarm (PERR) on the CENTUM side.
Note that detection of answerback errors does not affect the output behavior of OUT.
Answerback Check Mask
In practice, it takes some time for operations to be completed after changing the value of
OUT. For this reason, MOB_21 is equipped with MTM (answerback check mask time). By
setting this parameter, it is possible to prevent errors from being notified for a fixed time
specified by MTM after OUT is changed, even if the value of OUT and the answerback input
values are different. After the value of OUT is changed, if the answerback input status is still
abnormal after the time specified by MTM has elapsed, answerback errors on the open and
close sides are output to NANP and NANM, respectively.
Note that NPER (answerback pattern error) is detected independently of the answerback
check mask time.
Timing to Perform Answerback Check Processing
The answerback check and answerback check mask processing can be performed either
while a shutdown instruction is being output, application logic signals are being output
because the input to SW is FALSE, or manual operations from an HIS are performed
because the input to SW is TRUE.

Relationship between Answerback Check and Parameters
The figure below shows how each parameter changes due to answerback check processing.
Open Close Open Close Open
T
OUT
F
AINP T
Open side
answerback F
AINM T
Close side
answerback F
MTM
Mask timer
0
NANP
T
Error of open side
answerback F
NANM T
Error of close side
answerback F
NPER T
Answerback
pattern error F
Alarm status NR ANS+ NR ANS- NR PERR NR
Answerback error Answerback error Answerback

Instrument faceplate alarm of ON side alarm of OFF side inconsistency
of CENTUM alarm
2
MV 0
2
1
PV 0
Hold previous value
D040110E.ai
Figure Detection of Answerback Errors in MOB_21
When OUT changes, the mask timer for answerback check will be started. The mask for
answerback check will continue until the time specified by MTM has elapsed. Within this
masked time period, the answerback error will be ignored.
Immediately after the value of OUT is changed, TRUE (normal) is set to NANP and NANM
once. Process alarms of answerback errors are also canceled once.
In the case of an answerback pattern error (NPER is FALSE), the answerback statuses on
both the open and close sides (NANP and NANM) are retained.
In detection of answerback pattern errors (NPER), answerback check mask is ignored.
FALSE (abnormal) is thus output to NPER as soon as the conditions for pattern error are
met (AINP = TRUE and AINM = TRUE).
When the answerback check is masked and the answerback pattern error occurs, the
answerback check mask will be disabled. If the answerback pattern error is recovered and
the answerback check is performed, the results will be available in NANP and NANM.

D4.1.5 Monitoring IOP and OOP

IOP and OOP are functions that monitor the statuses of inputs and outputs and notify
process alarms on the CENTUM side. Inputs to IOP and OOP do not affect output
operations and answerback check operations of the function block.
n Parameters Related to IOP/OOP

Parameters related to IOP and OOP are the same for MOB_11 and MOB_21.
MOB_11
IOP
OOP
D040111E.ai

Figure Parameters Related to IOP and OOP

Table Explanation of Parameters Related to IOP/OOP
IN IOP BOOL Signal for monitoring input status
TRUE: Normal status
OOP BOOL Signal for monitoring output status
TRUE: Normal status
Signal Connection to IOP

In the case of MOB_11, connect the data status of the answerback input (input variable
connected to AIN) and similar signals to IOP.
In the case of MOB_21, connect the logical product of the data statuses of the two
answerback inputs (input variables connected to AINP and AINM) and similar signals to IOP.
Signal Connection to OOP

Connect the data status of the output (output variable connected to OUT) and similar signals to
OOP.

D4.1.6 Tag Name Interfaces and Process Alarms of MOB_11

and MOB_21
In order to manually operate BOOL-Type data manual operation function blocks with
answerback from an HIS, it is necessary to specify the tag names using the Tag Name
Builder and associate them with mapping blocks. This allows them to be called via tag
names and process alarms to be notified.
The following mapping blocks are associated with BOOL-Type data manual operation
function blocks with answerback.
Mapping blocks of MOB_11: S_MOB_11
Mapping blocks of MOB_21: S_MOB_21

To perform manual operations from an HIS, make settings for the relevant instances of MOB_11
and MOB_21 in the Tag Name Builder. Specify whether or not to notify answerback error alarms
according to the following procedure.
Answer back Alarm (answerback error alarm)
Specify either [Both], [ON], [OFF] or [No].
The default is [Both].
Specify [ON] to detect only ANS+ alarms (PV 2 when MV = 2) and [OFF] to detect only
ANS- alarms (PV 0 when MV = 0).
n Data Items of S_MOB_11 and S_MOB_21

Among the data items of mapping blocks, the data items unique to S_MOB_11 and S_MOB_21
are explained here. All of these data items are displayed in the HIS tuning view.
SEE
the following:
MODE (Block Mode)

This data item indicates block mode. The block mode cannot be changed into AUT or MAN from
an HIS. The default value of MODE is O/S (AUT).
Associating parameters of function blocks
The SHDN (shutdown signal), SW (manual operation permit/prohibit toggle switch) and
OTEN (signal indicating output enable status) parameters of a function block are associated
with MODE.
Changes of block mode (AUT/MAN)
The block mode becomes AUT if SHDN matches with SS (safe state specification). If they
do not match, the block mode becomes MAN if TRUE is input to SW and AUT if FALSE is
input to SW.
Changes of block mode (output enable status)
The block mode IMAN is added to the block mode if OTEN is FALSE and IMAN is removed
from the block mode if OTEN is TRUE.

ALRM (Alarm Status)
Data entry from an HIS is not allowed.
SHDN (shutdown signal)

This data item displays signals used for shutdown logic. Data entry from an HIS is not allowed.
The SHDN parameter (shutdown signal) of a function block is associated with SHDN. The
SHDN value of a function block is reflected in this data item.
Range
The range of SHDN is 0 or 1.
Correspondence between changes of the parameter value of function blocks and changes
of SHDN
Changes of the SHDN (shutdown signal) value of a function block match with changes of
SHDN.
If the value of SHDN matches with SS (safe state specification), the value of SHDN is output
as a shutdown signal from the OUT parameter (corresponding to the data item MV) of a
function block.
SS (Safe State Specification)

This data item displays the safe state (value output as a shutdown signal) of a shutdown signal.
The SS parameter (safe state specification) of a function block is associated with SS. The
SS value of a function block is reflected in this data item.
Range
The range of SS is 0 or 1.
INV (Logic Input Value)

This data item is associated with the value specified to be output under conditions where the
shutdown logic is disabled and operations from an HIS are prohibited. Data entry from an HIS is
not allowed.
The IN parameter (specified output value when manual operations are prohibited) of a
function block is associated with INV. The default value of IN of a function block is reflected
in this data item.
Range
The range of INV is 0 or 2.
of INV
INV is 2 if the IN parameter of a function block is TRUE and 0 if IN is FALSE.

SW (Switch)
This data item displays the status of the manual operation toggle permit/prohibit switch of
a function block. Data entry from an HIS is not allowed. Operations on MV from an HIS are
permitted when the value of SW is 1 and MODE becomes MAN.
The SW parameter (manual operation permit/prohibit toggle switch) of a function block is
associated with SW. The SW value of a function block is reflected in this item.
Range
The range of SW is 0 or 1.

This data item displays answerback input signals of a function block. Data entry from an HIS is
not allowed. It is displayed in the parameter display area of instrument faceplate and will be a
target of data collection for tuning trend.
For MOB_11, the AIN parameter (answerback input value), and for MOB_21, the
combination of values of AINP (answerback input value of the open side) and AINM
(answerback input value of the close side) is associated with PV.
Range
The range of PV is 0, 1 or 2.
Correspondence between changes of the parameter value of MOB_11 and changes of PV
PV=2 if AIN (answerback input value) of MOB_11 is TRUE (open) and PV=0 if FALSE
(close).
Correspondence between changes of the parameter value of MOB_21 and changes of PV
In MOB_21, the value of PV changes according to the combination of values of AINP
(answerback input value of the open side) and AINM (answerback input value of the close
side).
- PV=2 if AINP=TRUE (full open) and AINM=FALSE (not full-close)
- PV=1 if AINP=FALSE (not full-open) and AINM=FALSE (not full-close)
- PV=0 if AINP= FALSE (not full-open) and AINM=TRUE (full close)
- PV retains the previous value if AINP=TRUE (full open) and AINM=TRUE (full close)
Default
The default value (0) of the associated parameter of the function block is reflected in the
default value of PV.

This data item is associated with the operation output value of a function block. Its value can be
changed if manual operations from an HIS are permitted (MODE=MAN). It is displayed in the
trend.
The OUT parameter (open/close operation output value) of function blocks is associated
with MV.
Range
of MV
The value of OUT of the associated function block is TRUE (the operation output value is
open) if MV=2, and OUT is FALSE (the operation output value is close) if MV=0.
When operations from an HIS are permitted (MODE=MAN), the output value OUT of a
function block is changed if MV is manipulated from the HIS. Changes of the value of OUT
can be monitored on the HIS as changes of MV.
Default
MTM (Mask Time)

This data item displays the answerback check mask time. The default value is 0. The unit is
seconds and the fractional part indicates milliseconds. Data entry from an HIS is not allowed.
The MTM parameter (answerback check mask time) of a function block is associated with
MTM.

Process Alarms
MOB_11 and MOB_21 notify process alarms of answerback error and IOP/OOP.
Answerback Error Alarms

If an answerback error occurs, a process alarm is notified when the associated parameter of a
function block changes under the following conditions. Notification of generation of answerback
pattern errors and recovery from the errors is made only from MOB_21.
Notification of answerback error on the open side (ANS+): At a falling edge of NANP
Notification of answerback error on the close side (ANS-): At a falling edge of NANM
Notification of answerback pattern error (PERR): At a falling edge of NPER
If the system recovers from an answerback error, a process alarm is notified. The notification is
made when the parameters of a function block change under the following conditions.
Recovery notification of answerback error on the open side (ANS+ cancellation):
At a rising edge of NANP
Recovery notification of answerback error on the close side (ANS- cancellation):
At a rising edge of NANM
Recovery notification of answerback pattern error (PERR cancellation):
At a rising edge of NPER
IOP and OOP

If you connect a signal indicating whether or not the answerback input signal is normal to the
IOP parameter and a signal indicating whether or not the output signal is normal to the OOP
parameter, input/output errors can be notified as process alarms. The notification is made if the
parameters of a function block change under the following conditions.
Input error occurrence alarm: At a falling edge of IOP
Output error occurrence alarm: At a falling edge of OOP
The notification of recovery is made if the parameters of the function blocks change under the
following conditions.
Input error recovery alarm: At a rising edge of IOP
Output error recovery alarm: At a rising edge of OOP

<D4.2 HIS Interfaces of MOB_RS (Auto-Reset BOOL-Type Data Manual Operation)> D4-22
D4.2 HIS Interfaces of MOB_RS (Auto-Reset

BOOL-Type Data Manual Operation)
Auto-Reset BOOL-type data manual operation function blocks output pulses when
operated manually from an HIS.
D4.2.1 Operations of MOB_RS from HIS

This section explains the following functions of MOB_RS.
Permission of manual operations and automatic reset of operation output values
Answerback check
SEE
ALSO For an explanation of parameters of MOB_RS, see the following:
C5.6, MOB_RS (Auto-Reset BOOL-Type Data Manual Operation)
Example of Configuration of MOB_RS

The figure below shows a usage example of MOB_RS in a CENTUM integration structure.
MAN
NR
CENTUM
MODE
SCS
MV
PV
Application logic
Manual operation SET
permission logic SW
Q1
AIN OUT RESET1
FALSE ADIR
NANM ANSV
T#1s MTM
D040201E.ai
Figure Overview of MOB_RS Configuration
The associated parameter values of the SCS function block are sent to indicate the block mode
(MODE) and answerback input value (PV) on the CENTUM side via the mapping blocks. The
value of OUT is displayed as MV on the HIS instrument faceplate and operations on MV from the
HIS are sent to OUT of the SCS in the manual mode (MAN).

Overview of Processing MOB_RS

HIS Auto-Reset BOOL-Type data manual operation block
Flow of control
SW Flow of data
FALSE
SW equal to FALSE
Pulse
generator OUT
SW equal to TRUE
Value from
HIS (MV)
This variable always follows the valve of OUT except
when the data from HIS is received.
D040202E.ai
Figure Flow of Control and Data of MOB_RS
Prohibition of Manual Operations

If the manual operation permit switch SW is FALSE, OUT is fixed to FALSE. If an operator
attempts to perform manual operations from an HIS when the input to SW is FALSE
(manual operations prohibited), the attempt will fail.
Permission of Manual Operations and Automatic Reset of Operation Output Value
Manual operations by an operator from an HIS are permitted if TRUE is input to SW. If MV is
changed from 0 to 2 in an HIS, the output value of OUT of MOB_RS changes to TRUE. The
output of OUT returns to FALSE automatically after the next scan in the scan period. The
value of MV in the CENTUM system also returns to 0.
Confirmation of MOB_RS Behavior via Answerback Input

The output value of MOB_RS caused by manual operations returns to FALSE quickly and an
operator typically cannot check whether the manual operations were acknowledged or not.
To alleviate this problem, it is a good idea to create a latch variable or similar that is reset by a
pulse signal output from MOB_RS and input its value to the answerback input of MOB_RS. The
changes of this value can then be displayed in the instrument faceplate. This way, it is possible to
check whether the manual operations took effect through the instrument faceplate.

Answerback Check
The following parameters are related to answerback check of MOB_RS.
MOB_RS
AIN
ADIR
OUT
MTM
NANM
D040203E.ai
Note: The SW parameter is omitted.

Figure Parameters Related to Answerback Check of MOB_RS

IN AIN BOOL Answerback input value
ADIR BOOL Answerback operation direction specification
TRUE: Forward operation
FALSE: Reverse operation
OUT OUT BOOL Operation output value for logic reset (pulse signal)
NANM BOOL Answerback status
TRUE: Normal status
Answerback Operation Direction

Specify whether the answerback input signal becomes TRUE at normal or abnormal status,
using the answerback operation direction specification (ADIR).
Specification of forward operation
A forward operation refers to an operation where the answerback signal is latched to TRUE
when the specified events occur and return to FALSE due to the pulse output from OUT.
Specify TRUE for ADIR.
Specification of reverse operation
A reverse operation refers to an operation where the answerback signal is latched to FALSE
when the specified events occur and return to TRUE due to the pulse output from OUT.
Specify FALSE for ADIR.

Answerback Operation at Forward Operation
In a forward operation, the relationship between the output signal OUT and the answerback
signal is as illustrated in the figure below.
If the latch is not
unlatched in some
reason, ANS- occurs
Transition by Manual operation Auto-Reset by Transition by

application by operator function block application
MAN AUT MAN MAN MAN MAN

NR NR NR NR NR NR
MV PV
MV PV
At normal Demand occrus Demand cleared Unlatch operation MV auto-reset Unlatched

MV = 0 MV = 0 MV = 0 MV = 2 MV = 0 MV = 0
PV = 0 PV = 2 PV = 2 PV = 2 PV = 2 PV = 0
2
MV 0
T
OUT
F
T
AIN
F
SW T
F D040204E.ai
Figure Relationship between MV Manipulation and Answerback (Forward Operation)
The data items of CENTUM and parameter values of MOB_RS are related in the following ways.
The AIN parameter (answerback input value) of MOB_RS is associated with PV on the
CENTUM side. PV=2 if AIN=TRUE and PV=0 if AIN=FALSE.
The OUT parameter of MOB_RS is associated with MV on the CENTUM side. OUT=TRUE
if MV=2 and OUT=FALSE if MV=0.
1. At normal status, MV=0 and FALSE is output to OUT of MOB_RS.
2. Create application logic such that AIN of MOB_RS is latched to TRUE at the occurrence of a
demand. If AIN becomes TRUE, PV becomes 2.
3. If MV is changed to 2 from an HIS to reset the latch, OUT of MOB_RS changes to TRUE.
OUT returns to FALSE after one scan (automatic reset).
4. Create application logic such that the latch is reset upon changes of OUT from FALSE to
TRUE and AIN returns to FALSE. PV becomes 0 if AIN becomes FALSE.

Answerback Operation at Reverse Operation
In a reverse operation, the relationship between the output signal OUT and the answerback
signal is as illustrated in the figure below.
If the latch is not
unlatched in some
reason, ANS- occurs
Transition by Manual operation Auto-Reset by Transition by

application by operator function block application
MAN AUT MAN MAN MAN MAN

NR NR NR NR NR NR
MV PV
MV PV
At normal Demand occrus Demand cleared Unlatch operation MV auto-reset Unlatched

MV = 0 MV = 0 MV = 0 MV = 2 MV = 0 MV = 0
PV = 2 PV = 0 PV = 0 PV = 0 PV = 0 PV = 2
2
MV
0
T
OUT
F
T
AIN
F
SW T
F
D040205E.ai
Figure Relationship between MV Manipulation and Answerback (Reverse Operation)
A reverse operation is normal if the values of PV and MV are opposite in the HIS instrument
faceplate.
Notification of Answerback Errors

An answerback error occurs if AIN (answerback signal) does not return to the normal value within
the time specified by MTM (answerback check mask time) after a pulse signal is generated by
manipulation of MV. The normal value of AIN is FALSE in the case of forward operations and
TRUE in the case of reverse operations. If an answerback error is detected, FALSE is output
from NANM (answerback status) and a notification is made to an HIS as a process alarm (ANS-)
on the CENTUM side.
The system recovers from an answerback error if MV is manipulated again or AIN (answerback
signal) returns to the normal value. On recovery, TRUE is output from NANM (answerback
status).
Note that if 0 seconds are specified for MTM, answerback check is started from the next scan
after OUT becomes TRUE.

D4.2.2 Tag Name Interfaces and Process Alarms of MOB_RS

In order to manually operate auto-reset BOOL-type data manual operation function blocks
from an HIS, it is necessary to specify the tag names using the Tag Name Builder and
associate them with mapping blocks. This allows them to be called via tag names and
process alarms to be notified.
Mapping blocks associated with auto-reset BOOL-type data manual operation function
blocks are S_MOB_RS.
Settings in Tag Name Builder

To perform manual operations from an HIS, make settings for the relevant instances of MOB_RS
in the Tag Name Builder. Specify whether or not to notify answerback error alarms according to
the following procedure.
Answer back Alarm (answerback error alarm)
Specify either [Both] or [No].
Specify [Both] to notify answerback error alarms. Only ANS- process alarms are generated
even if [Both] is specified.
Data Items of S_MOB_RS

Among the data items of mapping blocks, the data items unique to S_MOB_RS are explained
here. All of these data items are displayed in the HIS tuning view.
SEE
the following:
MODE (Block Mode)

an HIS. The default value of MODE is O/S (AUT).
The SW parameter (manual operation permit/prohibit toggle switch) of MOB_RS is
associated with MODE.
The block mode becomes MAN if TRUE is input to SW, and AUT if FALSE is input.
ALRM (Alarm Status)


This data item displays answerback input signals connected to MOB_RS. Data entry from an HIS
is not allowed. It is displayed in the parameter display area of instrument faceplate and will be a
The AIN parameter (answerback input value) of MOB_RS is associated with PV.
Range
Correspondence between changes of the parameter value of MOB_RS and changes of PV
PV=2 if AIN (answerback input value) of MOB_RS is TRUE and PV=0 if FALSE.
Default
The default value (0) of AIN is reflected in the default value of PV.

This data item is associated with the operation output value of MOB_RS. Its value can be
changed if manual operations from an HIS are permitted (block mode=MAN). It is displayed
tuning trend.
The OUT parameter (logic reset operation output value) of MOB_RS is associated with MV.
Range
of MV
MV=2 if OUT of MOB_RS is TRUE and MV=0 if FALSE.
When operations from an HIS are permitted (MODE=MAN), OUT of MOB_RS changes if
MV is manipulated from the HIS.
Default
SW (Switch)
This data item displays the status of the manual operation permit/prohibit toggle switch of a
function block. Data entry from an HIS is prohibited.
The SW parameter (manual operation permit/prohibit toggle switch) of a function block is
associated with SW. The SW value of MOB_RS is reflected in this item.
Range
MTM (Mask Time)

This data item display the answerback check mask time. The unit is seconds and the fractional
part indicates milliseconds. Data entry from an HIS is not allowed.
The MTM parameter (answer back check mask time) of MOB_RS is associated with MTM.
Default
The default value of MTM is 0.

Process Alarms
MOB_RS notifies answerback error alarms.
Answerback Error Alarms

If an answerback error occurs, a process alarm is notified when NANM of MOB_RS changes
under the following condition.
Notification of answerback error occurrence (ANS-): At a falling edge of NANM

<D4.3 HIS Interfaces of MOA (Analog-Type Data Manual Operation)> D4-30
D4.3 HIS Interfaces of MOA (Analog-Type Data

Manual Operation)
Analog-type data manual operation function blocks can monitor the values of analog
output variables via an HIS, and it is possible to change the output values from the HIS.
Analog-Type data manual operation function blocks also have a parameter for receiving
shutdown events and are able to output the shutdown logic signal with the highest
priority at the occurrence of a shutdown event.
D4.3.1 Operations of MOA from HIS

This section explains the following functions of MOA.
Feedback input
OOP detection
SEE
ALSO See the following for other functions of MOA.
For an explanation of parameters of MOA, see the following:
C5.7, MOA (Analog-Type Data Manual Operation)
The management of passwords for permitting manual operations is the same as for MOB_11 and MOB_21;
see the following:
D4.1.2, Password at Manual Operations
For output enable status display, see the following;
D4.1.3, Output Enable Status Display Function
Example of Configuration of MOA

The figure below shows a usage example of MOA in a CENTUM integration structure.
MAN
NR
CENTUM
MODE
SCS
ALRM
MV
FV
Shutdown logic SHDN

0.0 SDV
OUT AOVAR.v
Manual operation
permission logic SW
FEEDBACK FV
AOVAR.status OOP
OUTEN OTEN
'password' PSWD
D040301E.ai
Figure Analog-type Data Manual Operation Function Blocks
The associated parameter values of the SCS function block are sent to indicate the block mode
(MODE), process alarms (ALRM) and feedback input value (FV) on the CENTUM side via the
mapping blocks. The value of OUT is displayed as MV on the HIS instrument faceplate and
operations on MV from the HIS are sent to OUT of the SCS in the manual mode (MAN).

Overview of Processing MOA

HIS
Analog-Type data manual operation

Flow of control
SHDN Flow of data
SDV SHDN equal to FALSE
OUT
SW
SHDN equal to TRUE
IN SW equal to FALSE
Value from
SW equal to TRUE
HIS (MV)
This variable always follows the value of OUT except

when the data from HIS is received.
D040302E.ai
Figure Flow of Control and Data (MOA)
Shutdown Processing
If the input value of SHDN (shutdown signal) becomes FALSE, the value of SDV (shutdown
output value) is output from OUT. At this point, all data settings from input parameters other than
SHDN and SDV as well as an HIS are ignored.
The SHDN input of MOA supports only DTS logic (normal: TRUE, abnormal: FALSE). Connect
a reversed shutdown logic signal to SHDN in the case of ETS logic (normal: FALSE, abnormal:
TRUE).
Prohibition of Manual operations

If the input value of SHDN is set to TRUE (status where shutdown processing is not performed)
and the manual operation permit switch SW is set to FALSE (manual operations prohibited), the
value input to IN is output to OUT as is. If an operator attempts to perform manual operations
from an HIS when the input to SW is FALSE, the attempt will fail. IN can be used to change the
output value of OUT from the application logic when no shutdown instruction is input to SHDN
(i.e., the system is in a safe state).
Permission of Manual Operations

If the value of SHDN input is set to TRUE (i.e., the system is in a status where shutdown
processing is not performed) and the SW input is set to TRUE (manual operations permitted),
results of manual operations carried out by an operator from an HIS are output from OUT. Note
that password entry is required to perform manual operations. The password is checked within
a function block. If the password is incorrect, a warning message for the illegal operation will
be displayed and OUT will be unchanged. The status where manual operations are permitted
can be used when it is desired to change the output value by a user operation without issuing a
shutdown instruction from SHDN (i.e., the system is in a safe state).

Feedback Input
The feedback input (FV: data type is REAL) can be used for the purpose of checking the result
of manipulating MV from an HIS on instrument faceplate and so on. Input a signal indicating the
degree of opening of a valve or similar connected to the output variable channel connected to
OUT, to FV.
It is not checked that the values of OUT and FV match.
The value of FV is used for checking purposes only in an HIS. It has no influence on the
output behavior of OUT.
OOP Detection
It is possible to use OOP (whose data type is BOOL) to check whether or not an output signal is
normal. Input the data status of an output signal (output variable connected to OUT) or similar
to OOP. Process alarms are notified on the CENTUM side according to the change of the OOP
value.
The value of OOP has no influence on the output behavior of OUT.
D4.3.2 Tag Name Interfaces and Process Alarms of MOA

In order to manually operate analog-type data manual operation function blocks from an
HIS, it is necessary to specify the tag names using the Tag Name Builder and associate
them with mapping blocks. This allows them to be called via tag names and notification of
process alarms.
Mapping blocks associated with analog-type data manual operation function blocks are
displayed as S_MOA.
Settings in Tag Name Builder

To perform manual operations from an HIS, make settings for the relevant instances of MOA in
the Tag Name Builder. The settings related to MOA are as follows.
Output High and Low Limits

The output high and low limits are valid setting items when the block is in the mode that manual
operation is allowed (MODE=MAN). This indicates the range of MV value that can be set by the
operator without confirmation. When a value beyond the limits set from HIS to the MV, a dialog
box will be displayed for confirmation to set the MV beyond the limits. The MV can only be set
after confirmation.
This function is different from the Output Limiter function of FCS.
Output High Limit
Specify a value in the range from 0.0 to 100.0%. The default is 100.0%.
This item is associated with data item MH of mapping block.
Output Low Limit
Specify a value in the range from 0.0 to 100.0%. The default is 0.0%.
This item is associated with data item ML of mapping block.

Output Scale High and Low Limits
The output scale high and low limits are valid setting items when the block is in the mode that
manual operation is allowed (MODE=MAN). These settings indicate the upper and lower limits
at entering MV value from HIS. A value beyond these high and low limits can not be entered from
HIS.
Output Scale High Limit
The value of this item is fixed to 100.0%. The value cannot be changed.
This item is associated with data item MSH of mapping block.
Output Scale Low Limit
The value of this item is fixed to 0.0%. The value cannot be changed.
This item is associated with data item MSL of mapping block.
TIP
When a block is in a block mode that the manual operation is not allowed (MODE=AUT), the output from OUT will
not be affected by the output high and low limits or the output scale high and low limits. The values specified by
the parameters of IN or SDV of MOA will be intact and directly outputted.
Data Items of S_MOA

Among the data items of mapping blocks, the data items unique to S_MOA are explained here.
All of these data items are displayed in the HIS tuning view with the exception of SH and SL.
SEE
the following:
MODE (Block Mode)

an HIS.
The SHDN (shutdown signal), SW (manual operation permit/prohibit toggle switch) and
OTEN (signal indicating output enable status) parameters of MOA are associated with
MODE. The default value of MODE is O/S (AUT).
The block mode becomes AUT if SHDN is FALSE. If SHDN is TRUE, the block mode
becomes MAN if TRUE is input to SW and AUT if FALSE is input to SW.
Changes of block mode (output enable status)
The block mode IMAN is added to the block mode if OTEN is FALSE and IMAN is remove
from the block mode if OTEN is TRUE.
ALRM (Alarm Status)

This data item displays alarm status.

FV (Feedback Input Value)
This data item displays the feedback input signal connected to MOA. Data entry from an HIS is
not allowed. It is displayed in the parameter display area of instrument faceplate and will be a
The FV parameter (feedback input value) of MOA is associated with FV. The value of FV
changes according to the changes of the FV value of MOA.
Range
The range of FV is 0 to 100%.
Default
The default value of parameter (0%) of MOA is reflected in the default value of FV.

This data item is associated with the operation output value of MOA. Its value can be changed
if manual operations from an HIS are permitted (block mode=MAN). It is displayed in the
trend.
The OUT parameter (analog operation output value) of MOA is associated with MV.
The value of MV changes according to the changes of the OUT value of MOA.
Range
The range of MV is 0 to 100%.
Default
The default value of MV is 0%.
SHDN (shutdown signal)

This data item displays signals used for shutdown logic. Data entry from an HIS is not allowed.
The SHDN parameter (shutdown signal) of MOA is associated with SHDN. The SHDN value
of MOA is reflected in this data item.
Range
The range of SHDN is 0 or 1.
of SHDN
Changes of the SHDN (shutdown signal) value of MOA match with changes of SHDN.
If the value of SHDN is 0, the value of SDV (shutdown output value) is output as a shutdown
signal from the OUT parameter (corresponding to a data item MV) of MOA.
SDV (Shutdown Output Value)

This data item displays a value output as a shutdown signal when shutdown processing is
performed. Data entry from an HIS is not allowed.
The SDV parameter (shutdown output value) of MOA is associated with SDV. The SDV
value of MOA is reflected in this data item.
Range
The range of SDV is 0 to 100%.

INV (Logic Input Value)
This data item is associated with the value specified to be output under conditions where the
shutdown logic is not effective and operations from an HIS are prohibited. Data entry from an HIS
is not allowed.
The IN parameter (specified output value when manual operations are prohibited) of MOA is
associated with INV. The default value of IN of MOA is reflected in this data item. The value
of INV changes according to changes of the IN value of MOA.
Range
The range of INV is 0 to 100%.
SW (Switch)
This data item displays the status of the manual operation permit/prohibit toggle switch of MOA.
Data entry from an HIS is not allowed. Operations on MV from an HIS are permitted when the
value of SW is 1 and MODE becomes MAN.
The SW parameter (manual operation permit/prohibit toggle switch) of MOA is associated
with SW. The SW value of MOA is reflected in this item.
Range
MSH (Output Range High Limit)

This data item displays the output scale high limit. Data entry from an HIS is not allowed. The
value is fixed to 100%.
MSL (Output Range Low Limit)

This data item displays the output scale low limit. Data entry from an HIS is not allowed. The
value is fixed to 0%.
MH (Output High Limit)

This data item displays the output high limit defined in the Tag Name Builder. Data entry from an
HIS is not allowed. The range is 0 to 100%.
ML (Output Low Limit)

This data item displays the output low limit defined in the Tag Name Builder. Data entry from an
HIS is not allowed. The range is 0 to 100%.
SH (FV Scale High Limit)

This data item is used to display the high limit of FV bar in an instrument faceplate. The value is
fixed to 100%.
SL (FV Scale Low Limit)

This data item is used to display the low limit of the FV bar in an instrument faceplate. The value
is fixed to 0%.

Process Alarms
MOA notifies process alarms of OOP.
OOP
If you connect a signal indicating whether or not the output signal is normal to the OOP
parameter of MOA, output errors are notified as process alarms. The notification is made if the
parameter of MOA changes under the following condition.
Output error occurrence alarm: At a falling edge of OOP
The notification of recovery is made if the parameter of MOA changes under the following
condition.
Output error recovery alarm: At a rising edge of OOP

<D5. Data Setting Using External Communication Function Blocks> D5-1
D5. Data Setting Using External

Communication Function Blocks
Data setting from FCSs is performed via tag name interfaces using external
communication function blocks dedicated for data setting. These function blocks allow
data setting not only from FCS, but also from HIS. External communication function
blocks are provided for each of the data types.
n Data Setting from FCS

In order to set data via tag name interfaces, define tag names for instances of external
communication function blocks in Tag Builder in an SENG. Once tag names are defined,
mapping elements (%WB) are generated. By accessing these mapping elements using the
syntax <tag name>.<data item>, data can be referenced and set. The table below lists data
item names used when accessing data.
Table Data Items of Tag Name Interfaces
External Data item name
communication FB (referencing and setting)
ECW_B PV
ECW_I PVI32
ECW_R PVF32
Tag name interfaces use the same data item names for referencing and setting data. For
example, if the tag name TAG0702 is defined for an ECW_I function block, the specification
TAG0702.PVI32 can be used when both referencing and setting data of this function block. If
the tag name TAG0703 is set for an ECW_R function block, TAG0703.PVF32 is used to access
data.
FCS
TAG0701.PV
TAG0701 OUT
Tag name interface Internal variable
SFC mapping <BOOL data>
ECW_B
block element (%WB)
TAG0702.PVI32
TAG0702
Tag name interface Internal variable OUT
mapping <DINT data>
element (%WB) ECW_I
Control bus
TAG0703 OUT
Application Tag name interface Internal variable <REAL data>
mapping
accessing data TAG0703.PVF32 ECW_R
element (%WB)
by the tag name
HIS
SCS
D050001E.ai
Figure Data Setting Using Tag Name Interfaces of External Communication Function Blocks

<D5.1 Confirmation of Setting Data> D5-2
D5.1 Confirmation of Setting Data

In order to use data set by external communication function blocks in an application used
in a safety loop, it is necessary to incorporate certain safety measures (various functions
to secure safety) with a user application.
An example that uses an application logic that checks the status of data set from an HIS
or FCS as a safety measure is shown below.
n Confirmation of Data Set via Tag Name Interfaces

The data set from an FCS is stored temporarily in a mapping element (WT003) and then
reflected in an external communication function block. The figure below shows an example of an
application that checks whether the set data reached the application logic or not.

WT003.PVI32
Tag name interface WT003 Internal
mapping variable
User element (%WB) OUT READBACK
Application
ECW_I DINT-type
RB003.PVI32 variable
Tag name interface RB003
mapping
element (%WB)
FCS SCS
Control bus
D050002E.ai
Figure Example of Application that Checks Data Setting Using Readback Variable
Connect the variable READBACK (DINT-type variable) to the OUT variable so that the output
from the OUT variable can be read back with a user application. By doing so, it can be confirmed
that the data has been set correctly.
The procedure to set DINT-type data is shown below.
1. Define a tag name for data setting for an ECW_I (external communication function block)
(WT003 in the example).
2. Define a tag name for data readback for the variable that will be used for reading the desired
data back (RB003 in the example).
3. Set data from the external device (FCS in this example) using the specification <tag name
for data setting>.PVI32. In the example, data is set via WT003.PVI32.
4. Read the data back to the external device (FCS in the example) using the specification
<tag name for data readback>.PVI32. In the example, data is read back via RB003.PVI32.

<D5.2 Tag Name Interfaces of External Communication Function Blocks> D5-3
D5.2 Tag Name Interfaces of External

This section explains data items of mapping elements associated with external
communication function blocks.
n Data Items of Mapping Elements Associated with External

By associating tag names with ECW_B, ECW_I and ECW_R type function blocks, it becomes
possible to set data from outside an SCS using tag name interfaces. If you define tag names
using the Tag Name Builder, mapping elements are created in the communication input/output
(%WB) area.
Mapping elements of external communication commonly have OPMK data items.
SEE
Data Items of Mapping Elements (%WB) Associated with ECW_B (PV)

The Boolean value of ECW_B is displayed as PV. It is displayed in the HIS tuning view and the
parameter display area of instrument faceplate, and will be a target of data collection for tuning
trend. Data entry from an HIS is allowed. The range is 0 or 1. The default value of ECW_B is
reflected in the default value of PV.
Data Items of Mapping Elements (%WB) Associated with ECW_I (PVI32)

The integer value of ECW_I is displayed as PVI32. It is displayed in the HIS tuning view and the
parameter display area of instrument faceplate. Data entry from an HIS is allowed.
The range is all signed 32-bit integers. The default value of ECW_I is reflected in the default
value of PVI32.
Data Items of Mapping Elements (%WB) Associated with ECW_R (PVF32)

The value of ECW_R is displayed as PVF32 (a real number). It is displayed in the HIS tuning
view and the parameter display area of instrument faceplate. Data entry from an HIS is allowed.
The range is all single precision real numbers. The default value of ECW_R is reflected in the
default value of PVF32.

<D6.1 Referencing FCS Data from SCS> D6-1
D6. SCS Global Switch Communication

By using SCS global switch communication of the SCS link transmission function, data
can be sent and received between a CENTUM station (FCS, APCS, and GSGW, hereafter
collectively referred to as FCS) and an SCS.
D6.1 Referencing FCS Data from SCS

When sending of global switch value to other stations is permitted at an FCS, values set
from %GS001 to %GS256 at the FCS can be received at an SCS as BOOL-type data.
n Referencing FCS Data

The LTFCS function block is used to reference FCS %GS data. LTFCS is an interference-free
function block. It cannot be used for safety loop.
Data referenced with the LTFCS function block is defined by wiring the link transmission data
area and LTFCS function block in SCS Link Transmission Builder.
SCS
Logic
LTFCS FB
(Interference-free)
Sender FCS
Global switch Link transmission

(%GS001 to %GS256) data area (32 bytes)
Control bus (link transmission)
D060001E.ai
Figure Referencing FCS Data
l Data Check Using CENTUM

For data set to an SCS from an FCS, check global switch data of the FCS.
To check the data received at an SCS from CENTUM stations, connect BOOL data to GSV
parameter of the LTFCS function block and give a tag name to the BOOL data.
To check the status of data received at an SCS from CENTUM stations, connect BOOL data
to STS parameter of the LTFCS function block and give a tag name to the BOOL data.
n Diagnosis of Communication Error

The communication status with an FCS is checked at an SCS. Regardless of the scan period of
SCS application logic, if data update from the FCS stops for 3 seconds, the SCS judges that a
communication error has occurred and starts the input processing at fault.
Possible causes of communication error are shown below.
The sending side FCS failed.
Control bus failed on both bus1 and bus2.

<D6.1 Referencing FCS Data from SCS> D6-2
n Processing upon Communication Error

If a SCS global switch communication error, including the sending side FCS stop, has occurred,
the SCS starts the input processing at fault.

Logical data of the link transmission data area received by the SCS will be set depending
on the input value at error occurrence defined on the Data Wiring definition of SCS Link
The data status will be BAD.
The data and data status above are output from the LTFCS function block.
l Notification of Communication Error

A diagnostic information message indicating Diagnostic Error will be sent from the SCS.
However, no diagnostic information message notifying errors related to SCS Link Transmission
will be sent during the SCS startup.
SEE
l Processing upon Communication Error Recovery

After the cause of communication error is removed and the receive data from the FCS becomes
normal, the error condition recovers automatically. If latching the data at communication error is
necessary, write the data latching logic in application logic.

Logical data of the link transmission data area received by the SCS will be the %GS value
sent by the FCS.
The data status will be GOOD.
The data and data status above are output from the LTFCS function block.
l Notification of Recovery from Communication Error

A diagnostic information message indicating Recovery from Diagnostic Error will be sent
from the SCS. However, no diagnostic information message related to SCS Link Transmission
notifying the recovery from the errors those occurred during the SCS startup will be sent.
SEE

<D6.2 Data Setting from SCS to FCS> D6-3
D6.2 Data Setting from SCS to FCS

If reception of global switch values from other stations is permitted at an FCS, data
from the link transmission data area of an SCS can be received by the FCS as global
switch data %GS001 to %GS128. The data received at FCS from %GS129 to %GS256 are
meaningless and thus should not be referenced on the FCS side.
n FCS Data Setting

The LTSND function block is used for setting data to an FCS. Input the BOOL-type data to be
sent to the LTSND function block, and perform wiring between the LTSND function block and link
transmission data area in SCS Link Transmission Builder.
SCS
Logic
LTSND FB
(Safety)
Receiving side FCS
Link transmission Global switch

data area (16 bytes) (%GS001 to %GS128)
Control bus (link transmission)
D060002E.ai
Figure FCS Data Setting
SEE
ALSO For engineering procedure flow, see the following:
n SCS Link Transmission in 2.1.6, Settings for Exchanging Data between FCS and SCS of the
Integration with CENTUM VP/CS 3000 (IM 32S01E10-21E)
For engineering function details required for engineering, see the following:
5.3, SCS Link Transmission Definition of the Engineering Reference (IM 32S04B10-21E)
For points to note on FCS data setting, see the following:
2.9, SCS Link Transmission of the Engineering Guide (IM 32S01C10-21E)
l When SCS is in Output Disable Status

When the data sending side SCS is in the Output Disable status, %GS of the FCS is set to 0 and
the data status will be BAD.
After the SCS output enable operation is performed, data specified in SCS Link Transmission
Builder will be set to %GS and the data status will change to GOOD.

Rev-1
Revision Information
Title : Safety Control Station Reference
Manual No. : IM 32S03B10-21E
Dec. 2009/3rd Edition/R2.03 or later*

*: Denotes the release number of the software corresponding to the contents of this users manual. The
revised contents are valid until the next edition is issued.
Introduction Added the description.
A1 Added the description for SCSP2.
A2 Changed the section number (Original: A3.)
A2 Added the description for SCSP2.
A2 Added the description for SDV53A.
A3 Changed the section number (Original: A2.)
A3.1 Newly added.
A3.1.1 Added the definition of SCS scan period (Some descriptions are moved from Engineering Guide.)
A3.1.2 Added the description for automatic scan period extension in SCS.
A3.1.3 Added the description for changing the scan period of SCS online.
A4.3 Added the description for SCSP2.
A4.4 Added the description for process alarms.
A8 Added the description for locking the inter-SCS Safety communication data.
A8.1 Added the description for SCSP2.
A8.4 Newly added.
A8.5 Changed the chapter number (Original: A8.4.)
A8.5 Added the description for locking the inter-SCS Safety communication data.
B2 Changed the description so as to support the online change of the input/output modules configuration.
B6.1.3 Newly added.
B6.2.6 Added the description for SCSP2 and SEC402.
B7 Added the description for SCSP2.
B7.3 Newly added.
C1.1 Added the description for new FB.
C9.5 to C9.19 Changed the chapter number.
C9.12 Changed the description for FB so as to support SCSP2.
C9.14 to C9.19 Changed the description for FB so as to support SCSP2.
C10.1 Changed the description for FB so as to support the automatic scan period extension specification.
C10.5 Changed the description for FB so as to support SEC402.
C10.6 Changed the description for FB so as to support SCSP2 and SEC402.
C10.7, C10.8 Changed the description for FB so as to support SCSP2.
D1 Added the description for SCSP2.
D2.1 Added the description for ANN_FUP mapping element.
D2.2 Changed the description for supporting SCSP2.
D2.3 Added the description for ANN_FUP mapping element.
Dec. 2008/2nd Edition/R2.02 or later

Overall CS 3000 was changed to CENTUM to refer to both CENTUM VP and CS 3000.
Overall Changed according to the specifications of CENTUM VP.
A3 Description was modified for supporting the output module SDV526.
A4.1 Description was modified for supporting the output module SDV526.
A4.2 Description was modified for the specification change of online downloading.
A8.4.2 Description was modified for the specification change of online downloading.
B4.1 Description was added for the IOM Report. Description was modified for supporting the output module
SDV526.
B6.2.4 Description was modified for supporting the output module SDV526.

Rev-2
May 2008/1st Edition/R2.01 or later
Newly published.
n For Questions and More Information

Online Query: A query form is available on the following URL for online query.
http://www.yokogawa.com/iss/
If you want more information about Yokogawa products, you can visit
Yokogawas homepage at the following web site.
Homepage: http://www.yokogawa.com/
n Written by Process Automation Product Marketing Dept.
Industrial Automation Systems Business Div.
Yokogawa Electric Corporation
n Published by Yokogawa Electric Corporation
2-9-32 Nakacho, Musashino-shi, Tokyo 180-8750, JAPAN

S03B1021

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

S03B1021

Uploaded by

Copyright:

Available Formats

Users

Structure of this document is as follows:

Part A SCS Common

ProSafe-RS Document Map

Safety Control Station Integration with Open Interfaces

Engineering Utilities and Messages

IM 32S03B10-21E 2nd Edition : Dec.15,2008-00

Indicates that main switch is ON.

Indicates that main switch is OFF.

IM 32S03B10-21E 1st Edition : May 30,2008-00

n Notes on Handling User Manuals

n Warning and Disclaimer

IM 32S03B10-21E 1st Edition : May 30,2008-00

l Commonly used Conventions throughout User manuals:

Character strings in the following font and style:

Character string enclosed by brackets ({ }):

l Conventions used to show Key or Button Operations:

Characters enclosed by square brackets ([ ]):

l Conventions of User Defined Folder

IM 32S03B10-21E 2nd Edition : Dec.15,2008-00

Indicates a source to be referred to.

n Integration with CENTUM

IM 32S03B10-21E 2nd Edition : Dec.15,2008-00

n About Explanation of System Behavior

n About Station Types

IM 32S03B10-21E 3rd Edition : Dec.22,2009-00

Copyright and Trademark Notices

IM 32S03B10-21E 3rd Edition : Dec.22,2009-00

IM 32S03B10-21E 3rd Edition : Dec.22,2009-00

IM 32S03B10-21E 3rd Edition : Dec.22,2009-00

IM 32S03B10-21E 3rd Edition : Dec.22,2009-00

IM 32S03B10-21E 3rd Edition : Dec.22,2009-00

IM 32S03B10-21E 3rd Edition : Dec.22,2009-00

IM 32S03B10-21E 3rd Edition : Dec.22,2009-00

IM 32S03B10-21E 3rd Edition : Dec.22,2009-00

IM 32S03B10-21E 1st Edition : May 30,2008-00

A1. Overview of SCS

n Overview of SCS Software Configuration

Communication data RS-232C

SENG: Station that handles engineering and maintenance of SCS

Figure Overview of SCS Function Configuration

IM 32S03B10-21E 3rd Edition : Dec.22,2009-00

n Application Logic Execution Function

IM 32S03B10-21E 1st Edition : May 30,2008-00

n External Communication Function

l PRM-supported HART On-demand Communication

n Scan Period and Time Management

IM 32S03B10-21E 3rd Edition : Dec.22,2009-00

A2. SCS Hardware

l Combination of CPU Nodes and CPU Modules

l Definition of SCS Station Types

IM 32S03B10-21E 3rd Edition : Dec 22,2009-00

IM 32S03B10-21E 3rd Edition : Dec.22,2009-00

RCV 1 2 RCV LED

Figure LED Layout on the Front of the CPU Module

IM 32S03B10-21E 3rd Edition : Dec 22,2009-00

n HKU (House Keeping Unit)

n Types of Input/Output Modules

l Analog Input/Output Modules

IM 32S03B10-21E 3rd Edition : Dec.22,2009-00

IM 32S03B10-21E 3rd Edition : Dec.22,2009-00

IM 32S03B10-21E 3rd Edition : Dec.22,2009-00

A3. Scan Period and Time

A3.1. Scan Period of SCS