HIMA HIQuad H41X, System Manual

Page: 17 / 110

System Concept for HIQuad X
HI 803 211 E Rev. 1.01.00 Page 17 of 110
3.2.2 The H51X Redundancy System
During redundant operation with two processor modules, both system buses are used to
process the signals. This variant with redundant processor modules and system buses
increases the system's availability, see Figure 4. If a processor module fails, it automatically
enters the safe state and the redundant processor module maintains safe operation. The faulty
processor module must be replaced to ensure continued availability. The processor module can
be replaced while the system is operating.
Figure 4: Example of Safe H51X Redundant Operation (1oo2)
In contrast to mono operation, the entire design of a redundant system is intended to ensure
availability. Redundant input modules safely record the values measured by redundant sensors.
They exchange data with the processor modules via the safety-related I/O processing modules.
The measured values are cyclically queried and compared by the redundant processor
modules, and then processed by the user program. The user program's results are sent to the
I/O processing module, which writes them to the redundant output modules. The output
modules thus control the field level, e.g., the actuators. The example in Figure 4 shows a
redundant structure of field level and extension racks.