Structure

The module is equipped with 32 HART channels for HART communications with transmitters or

actuators. The HART channels are electrically isolated from one another and from the voltage

supply. Analog input or output modules are connected in parallel with the HART module via the

corresponding connector board, see Chapter 5.4.2 and Chapter 5.4.4.

The transmitter supply as well as the open-circuit and short-circuit monitoring functions for the

analog input and output modules are not affected by the HART module connected in parallel.

HART operation influences the analog measurement accuracy by approx. 1 %.

The safety-related 1oo2 processor system for the I/O module controls and monitors the I/O

level. The data and states of the I/O module are made available to the processor modules via

the redundant system bus. The system bus has a redundant structure for reasons of availability.

Redundancy is only ensured if both system bus modules are inserted in the base plates and

configured in SILworX.

Safety Function

The safety function of the X-HART module includes the following points:

 HART Deactivation of one channel: If the module is shut down, the HART channels are

safely deactivated in accordance with SIL 3 (HART channels de-energized).

 HART Filtering: HART write access to HART transmitters or sensors is locked in accordance

with SIL 3. If the HART filtering function is deactivated on the HART module, the

corresponding analog input or output channel is writeable.

Reaction in the Event of a Fault

If a fault occurs, the module adopts the safe state.

The X-HART module is interference-free to the analog input or output modules connected in the

same circuit.

The module activates the Error LED on the front plate.

Scope of Delivery

The module must be installed on a suitable connector board to be able to operate. If a Field

Termination Assembly (FTA) is used, a system cable is required to connect the connector board

to the FTA. Connector boards, system cables and FTAs are not included within the scope of

delivery.

Product Description

The X-HART 32 01 module is a 32-channel communication module, intended for use in the

programmable electronic system (PES) HIMax.

The module is inserted into any of the base plate slots with the exception of the slots reserved

for system bus modules. For more information, refer to the System Manual (HI 801 001 E).

The connector boards can be used to allow the module to be combined with analog input or

output modules.

The HART protocol is operated on the module. HART is used for digital field communications

during which the HART signal is superimposed onto the (4…20 mA) analog current signal.

The HART signal is used to transfer the measuring and device data to sensors or actuators. The

X-HART modules transfer the HART data to the assigned X-COM module within the HIMax

system. The X-COM module transfers the HART data via the HART over IP protocol to the host

(asset management system or HART OPC server).

The X-COM module and the assigned X-HART modules form a I/O system as referred to in the

HART specification.

The module has been certified by the TÜV for safety-related applications up to SIL 3

(IEC 61508. IEC 61511 and IEC 62061) as well as Cat. 4 and PL e (EN ISO 13849-1).

Refer to the HIMax Safety Manual (HI 801 003 E) for more information on the standards used to

test and certify the module and the HIMax system.

Structure

The module is equipped with 16 analog current outputs (0/4…20 mA) that are pairwise

electrically isolated from the supply voltage and the remaining channel pairs. The analog

current value is set with a D/A converter, measured by two independent, internal measuring

devices and functionally tested.

If two modules are redundantly connected, only 8 odd outputs (AO1. AO3…AO15) are

available. The even outputs (AO2. AO4…AO16) are not used.

The module automatically diagnosis open-circuits (OC) and can be evaluated in the user

program, see Chapter 4.3.

The safety-related 1oo2 processor system for the I/O module controls and monitors the I/O

level. The data and states of the I/O module are made available to the processor modules

via the redundant system bus. The system bus has a redundant structure for reasons of

availability. Redundancy is only ensured if both system bus modules are inserted in the

base plates and configured in SILworX.

Safety Function

The module ensures its safety function using one extra safety switch for each channel pair

that is opened if a failure occurs.

The safety function is performed in accordance with SIL 3.

Reaction in the Event of a Fault

If the safety-related processor system of the module detects a module fault during

operation, the module adopts the safe state after a maximum of 16 ms and all the outputs

are de-energized in accordance with the ‘de-energize to trip principle’. If a channel fault

occurs, both channels of the affected channel group are switched off.

The module activates the Error LED on the front plate.

Scope of Delivery

The module must be installed on a suitable connector board to be able to operate. If a FTA

is used, a system cable is required to connect the connector board to the FTA. Connector

boards, system cables and FTAs are not included within the scope of delivery.

The connector boards are described in Chapter 3.6. the system cables are described in

Chapter 3.7. The FTAs are described in own manuals.

Product Description

The X-AO 16 01 analog output module is intended for use in the programmable electronic

system (PES) HIMax.

The module can be inserted in any of the base plate slots with the exception of the slots

reserved for system bus modules. For more information, refer to the System Manual

(HI 801 001 E).

The module is equipped with 16 analog outputs with a nominal range of 4…20 mA.

The analog outputs are suitable for connecting ohmic, inductive and capacitive loads and

lamps in accordance with EN 61131-2.

The module has been certified by the TÜV for safety-related applications up to SIL 3

(IEC 61508. IEC 61511 and IEC 62061), Cat. 4 (EN 954-1) and PL e (EN ISO 13849-1).

Refer to the HIMax Safety Manual for more information on the standards used to test and

certify the modules and the HIMax system.

Safety Function

The module ensures its safety function using one extra safety switch for each channel pair

that is opened if a failure occurs.

The safety function is performed in accordance with SIL 3.

Scope of Delivery

The module must be installed on a suitable connector board to be able to operate. If a Field

Termination Assembly (FTA) is used, a system cable is required to connect the connector board

to the FTA. Connector boards, system cables and FTAs are not included within the scope of

delivery.

The connector boards are described in Chapter 3.6. the system cables are described in

Chapter 3.7. The FTAs are described in own manuals.

Structure

The module is equipped with 24 digital outputs. The outputs are not electrically isolated from

one another and from the voltage supply.

The module is equipped with line monitoring (SC/OC). If the open-circuit monitoring is

configured in SILworX, see Chapter 4.3. the channels are automatically checked for open

circuits (OC) and short-circuits (SC). The switching thresholds for line monitoring are predefined

and cannot be modified.

The outputs are protected against high currents. If a short-circuit occurs, the current at each

output is limited to 2 A.

If a current higher than 0.75 A flows through an output for 50 ms, the affected output is switched

off for 5 s. If the  overcurrent is still present after the outputs is automatically re-switched on, the

output is switched off again for 5 s. This process is repeated as long as the overcurrent is

present. If the cyclic switch-on after overcurrent must be prevented, the user program must be

configured accordingly.

The safety-related 1oo2 processor system for the I/O module controls and monitors the I/O

level. The data and states of the I/O module are made available to the processor modules via

the redundant system bus. The system bus has a redundant structure for reasons of availability.

Redundancy is only ensured if both system bus modules are inserted in the base plates and

configured in SILworX.

Safety Function

The module ensures its safety function using three safety switches connected in series for each

channel. This ensures that each output is two-fault-tolerant with respect to the safety switch.

Each safety switch of a channel can be individually switched off either via the system bus

(I/O bus) or via the second independent shutdown function (watchdog).

The safe output state is the de-energized state. Redundant processor systems monitor the

values expected for the outputs. Outputs that do not correspond to the expected values are

reset. One of the two read-back branches that were monitored for their expected values can be

tested.

The safety function is performed in accordance with SIL 3.

Reaction in the Event of a Fault

If a fault is detected, the module adopts the safe state and all the outputs are de-energized in

accordance with the ‘de-energize to trip principle’. If a channel fault occurs, only the

corresponding output is switched off; if a module fault occurs, all module outputs are switched

off.

If the system bus fails, the outputs are de-energized.

The module activates the Error LED on the front plate.

Product Description

The X-DO 24 01 digital output module is intended for use in the programmable electronic

system (PES) HIMax.

The module can be inserted into any of the base plate slots with the exception of the slots

reserved for system bus modules. For more information, refer to the System Manual

(HI 801 001 E).

The module is equipped with 24 digital outputs that can be loaded with a nominal current of up

to 0.5 A per channel. The supply voltage minus internal voltage drop is present on the outputs.

The outputs are suitable for connecting ohmic, inductive and capacitive loads and lamps.

The module has been certified by the TÜV for safety-related applications up to SIL 3

(IEC 61508. IEC 61511 and IEC 62061) as well as Cat. 4 and PL e (EN ISO 13849-1).

Refer to the HIMax Safety Manual (HI 801 003 E) for more information on the standards used to

test and certify the module and the HIMax system.

Safety Function

The module ensures its safety function using three safety switches connected in series for

each channel. This ensures that each output is two-fault-tolerant with respect to the safety

switch. Each safety switch of a channel can be individually switched off either via the

system bus (I/O bus) or via the second independent shutdown function (watchdog).

The safe output state is the de-energized state. Redundant processor systems monitor the

values expected for the outputs. Outputs that do not correspond to the expected values are

reset. The back-read branch is testable.

The safety function is performed in accordance with SIL 3.

Reaction in the Event of a Fault

If a channel fault occurs, the affected channel is set to the safe state. If a safety-relevant

fault occurs (e.g., multiple faults in one channel), the module adopts the safe state.

If the system bus fails, the outputs are de-energized.

The module activates the Error LED on the front plate.

Scope of Delivery

The module must be installed on a suitable connector board to be able to operate. If a FTA

is used, a system cable is required to connect the connector board to the FTA. Connector

boards, system cables and FTAs are not included within the scope of delivery.

The connector boards are described in Chapter 3.6. the system cables are described in

Chapter 3.7. The FTAs are described in own manuals.