Subordinate Safety Controller¶

If a safety controller is below the standard controller, then the communication with the development system and the data exchange run via the standard controller. The communication links of the safety controller can interrupted the execution of commands that affect the standard controller. You find a notice about this for each these command.

Possible interruptions

• Temporary interruption: During the execution of the command (for example: download), the connections with the safety controller are interrupted first and then are automatically available again afterwards. If the interruption time is too long, then safety-oriented reactions can occur in the output devices and connected network variable receiver safety controllers. Then in the safety controller, the corresponding communication errors must be acknowledged (if not done automatically) in order to end the safety-oriented reactions. This affects the connection to their field devices and network variable receiver connections to other sender safety controllers. In the case of a connected safety controller with network variable senders, the communication errors must be acknowledged in the other safety controllers.
• Permanent interruption: The execution of commands (for example: delete) leads to an interruption that is ended again by another action (for example: download). As a result of the interruption, safety-oriented reactions can occur in the output devices and connected network variable receiver safety controllers. After ending the interruption, the corresponding communication errors must be acknowledged in the safety controller (if not done automatically) in order to end the safety-oriented reactions.

For a subordinate safety controller, the routing runs via <Name of SafetyApp>_Mapping. In some cases, it can happen that the user can see this application in the device tree.

• Working with Control Networks