HIMA HIQuad H41X, Системное руководство

Страница: 23 / 110

System Concept for HIQuad X
HI 803 211 E Rev. 1.01.00 Page 23 of 110
3.3.2 The H41X Redundancy System
During redundant operation with two processor modules, both system buses are used to
process the signals. This variant with redundant processor modules and system buses
increases the system's availability, see Figure 9. If a processor module fails, it automatically
enters the safe state and the redundant processor module maintains safe operation. The faulty
processor module must be replaced to ensure continued availability. The processor module can
be replaced while the system is operating.
Figure 9: Example of Safe H41X Redundant Operation (1oo2)
In contrast to mono operation, the entire design of a redundant system is intended to ensure
availability. Redundant input modules safely record the values measured by redundant sensors.
They exchange data with the processor modules via the safety-related I/O processing modules.
The measured values are cyclically queried and compared by the redundant processor
modules, and then processed by the user program. The user program's results are sent to the
I/O processing module, which writes them to the redundant output modules. The output
modules thus control the field level, e.g., the actuators. The example in Figure 9 shows a
redundant structure of field level and extension rack.
During redundant operation, the signal is processed via both system buses A and B. The
system buses A and B between the I/O processing modules are implemented in a patch cable.