Safety Function

The remote I/O is equipped with safety-related analog inputs. The input values on the

inputs are safely transmitted to the connected controller via safeethernet. The outputs are

safely assigned their values by the connected controller via safeethernet.

Safety-Related Analog Inputs

The remote I/O is equipped with 8 analog inputs with transmitter supplies for the unipolar

measurement of voltages, referenced to L-.

The remote I/O is intended to measure the voltage on the inputs. To measure the current

on the inputs, connect a resistor of up to 500 Ω in parallel to each input.

Only shielded cables with a length of a maximum of 300 m must be connected to the

analog inputs. Each analog input must be connected to a twisted pair of wires. The

shielding must be connected to the remote I/O and the sensor housing and earthed of one

end to the remote I/O side to form a Faraday cage.

If an open-circuit occurs during voltage measurement (the line is not monitored), any input

signals are processed on the high-resistance inputs. The value resulting from this

fluctuating input voltage is not reliable; with voltage inputs, the channels must be terminated

with a 10 kΩ resistor. The internal resistance of the source must be taken into account.

For a current measurement with the shunt connected in parallel, the 10 kΩ resistor is not

required.

The analog inputs are designed to retain the metrological accuracy for 10 years. A

recalibration must be carried out every 10 years.

Product Description

The safety-related F3 AIO 8/4 01 remote I/O is a compact system located in a metal

enclosure with 8 analog inputs and 4 analog outputs.

The remote I/O is available in three model variants for SILworX and three model variants

for ELOP II Factory, see Chapter 3.3. All variants are described in this manual.

The remote I/O serves as extension of the I/O level of HIMax and HIMatrix controllers, and

is connected to them via safeethernet. The remote I/O itself is not able to run a user

program.

The HIMatrix remote I/Os are not multi-master capable.

The remote I/O is suitable for mounting in Ex-zone 2. see Chapter 4.1.3.

The device has been certified by the TÜV for safety-related applications up to SIL 3 (IEC

61508. IEC 61511 and IEC 62061), Cat. 4 (EN 954-1) and PL e (EN ISO 13849-1). Further

safety standards, application standards and test standards are specified in the certificate

available on the HIMA website.

Safety Function

The module does not perform any safety-related functions.

The parameters and status for this module must not be used for safety functions.

Reaction in the Event of a Fault

If a module fault occurs, all outputs are switched off.

If the system bus fails, the outputs are de-energized.

The module activates the Error LED on the front plate.

Scope of Delivery

The module must be installed on a suitable connector board to be able to operate. If a Field

Termination Assembly (FTA) is use, a system cable is required to connect the connector board

to the FTA. Connector boards, system cables and FTAs are not included within the scope of

delivery.

The connector boards are described in Chapter 3.6. the system cables are described in

Chapter 3.7. The FTAs are described in own manuals.

Structure

The module is equipped with 12 relay outputs; each of these outputs can be energized by a

relay.

All 12 relay outputs are electrically safely isolated from one another. Each relay output is safely

isolated from the voltage supply of the module by its own contact circuit. For safe insulation, the

air and creeping distances are designed in accordance with IEC 61131-2 for overvoltage class II

up to 300 V.

Product Description

X-DO 12 51 is a NonSIL relay module intended for use in the programmable electronic system

(PES) HIMax.

The module can be inserted into any of the base plate slots with the exception of the slots

reserved for system bus modules. For more information, see System Manual (HI 801 001 E).

The module is equipped with 12 potential-free relay outputs. The relay outputs are suitable for

connecting ohmic and inductive loads.

It can be operated with safety-related modules and other NonSIL modules within one base

plate. Safety-related and NonSIL modules may not be wired redundantly.

The module is interference-free, in particular, with respect to EMC, electrical safety,

communication to the X-SB and X-CPU modules, as well as the user program.

Module and connector boards are mechanically coded, see Chapter 3.6.1. Coding avoids

installation of improper modules.

Refer to the HIMax Safety Manual (HI 801 003 E) for more information on the standards used to

test and certify the module and the HIMax system.

Structure

The module is equipped with 12 relay outputs. Each relay output is switched by two contacts in

series. After every cycle, the module reads the status of the forcibly guided contacts and

compares it status with the output variables.

The relays in use have forcibly guided contacts (EN 50205) and can be used for safety

shutdowns. Forcibly guided contacts are connected with one another mechanically such that the

normally open and the normally closed contacts cannot be closed simultaneously.

All 12 relay outputs are electrically safely isolated from one another. Each relay output is safely

isolated from the voltage supply of the module by its own contact circuit. For safe insulation, the

air and creeping distances are designed in accordance with IEC 61131-2 for overvoltage class II

up to 300 V.

For burner management systems, the switching current must be limited to 60 % of the maximum

allowed value using an external fuse in accordance with EN 298 and EN 50256 (VDE 0116).

Reaction in the Event of a Fault

If the safety-related processor system of the module detects a module fault during operation, the

module adopts the safe state and all the outputs are de-energized in accordance with the ‘de-

energize to trip principle’. If a channel fault occurs, only the affected channel is switched off.

The module activates the Error LED on the front plate.

Scope of Delivery

The module must be installed on a suitable connector board to be able to operate. If a Field

Termination Assembly (FTA) is used, a system cable is required to connect the connector board

to the FTA. Connector boards, system cables and FTAs are not included within the scope of

delivery.

The connector boards are described in Chapter 3.6. the system cables are described in

Chapter 3.7. The FTAs are described in own manuals.

Product Description

The X-DO 12 01 relay module is intended for use in the programmable electronic system (PES)

HIMax.

The module can be inserted into any of the base plate slots with the exception of the slots

reserved for system bus modules. For more information, see System Manual (HI 801 001 E).

The module is equipped with 12 potential-free relay outputs with forcibly guided contacts. The

relay outputs are suitable for connecting ohmic and inductive loads.

The module has been certified by the TÜV for safety-related applications up to SIL 3

(IEC 61508. IEC 61511 and IEC 62061) as well as Cat. 4 and PL e (EN ISO 13849-1).

Refer to the HIMax Safety Manual (HI 801 003 E) for more information on the standards used to

test and certify the module and the HIMax system.

Safety Function

The module performs its safety function using two safety relays that are connected in series and

continuously monitored by the safety-related processor submodule.

The safety function is performed in accordance with SIL 3.

Structure

The module is equipped with 32 digital outputs. The outputs are not electrically isolated from

one another and from the voltage supply.

The module is equipped with a current limiting function, which limits the total current of all the

32 outputs. Additionally, the module monitors the total current for overload. If an overload is

present for longer than 100 ms, all the outputs are switched off and switched on again after ten

seconds. If the overload is still present, all the outputs are switched off again for ten seconds.

This process is repeated as long as the overload is present.

If an output overload is detected, the corresponding channel is switched off and automatically

switched on again after five seconds as soon as the overload is no longer present.

The processor system for the I/O module controls and monitors the I/O level. The data and

states of the I/O module are made available to the processor modules via the redundant system

bus. The system bus has a redundant structure for reasons of availability. Redundancy is only

ensured if both system bus modules are inserted in the base plates and configured in SILworX.

Safety Function

The module does not perform any safety-related functions.

Each switch of a channel can be individually switched off via the system bus (I/O bus).

The parameters and status for this module must not be used for safety functions.

Reaction in the Event of a Fault

If a channel fault occurs, the affected channel is switched off. If a module fault occurs,

all outputs are switched off.

If the system bus fails, the outputs are de-energized.

The module activates the Error LED on the front plate.

Scope of Delivery

The module must be installed on a suitable connector board to be able to operate. If a Field

Termination Assembly (FTA) is used, a system cable is required to connect the connector board

to the FTA. Connector boards, system cables and FTAs are not included within the scope of

delivery.

The connector boards are described in Chapter 3.6. the system cables are described in

Chapter 3.7. The FTAs are described in own manuals.

Product Description

X-DO 32 51 is a digital NonSIL output module intended for use in the programmable electronic

system (PES) HIMax.

The module can be inserted into any of the base plate slots with the exception of the slots

reserved for system bus modules. For more information, see System Manual (HI 801 001 E).

The module is equipped with 32 digital outputs that can be loaded with a nominal current of up

to 0.5 A per channel. At high level, a voltage equivalent to the supply voltage is present on the

corresponding output.

The outputs are suitable for connecting ohmic, inductive and capacitive loads and lamps.

It can be operated with safety-related modules and other NonSIL modules within one base

plate. Safety-related and NonSIL modules may not be wired redundantly.

The module is interference-free, in particular, with respect to EMC, electrical safety,

communication to the X-SB and X-CPU modules, as well as the user program.

Module and connector boards are mechanically coded, see Chapter 3.6.1. Coding avoids

installation of improper modules.

Refer to the HIMax Safety Manual (HI 801 003 E) for more information on the standards

used to test and certify the modules and the HIMax system.