B&R X20SA4430 User manual

X20(c)SA4430
Data sheet V1.141 X20(c)SA4430 Translation of the original documentation 1
X20(c)SA4430
Information:
B&R makes every effort to keep data sheets as current as possible. From a safety point of view, how-
ever, the current version of the data sheet must always be used.
The certified, currently valid data sheet can be downloaded from the B&R website www.br-automa-
tion.com.
Organization of notices
Safety notices
Contain only information that warns of dangerous functions or situations.
Signal word Description
Danger! Failure to observe these safety guidelines and notices will result in death, severe injury or substantial damage to property.
Warning! Failure to observe these safety guidelines and notices can result in death, severe injury or substantial damage to property.
Caution! Failure to observe these safety guidelines and notices can result in minor injury or damage to property.
Notice! Failure to observe these safety guidelines and notices can result in damage to property.
Table 1: Organization of safety notices
General notices
Contain useful information for users and instructions for avoiding malfunctions.
Signal word Description
Information: Useful information, application tips and instructions for avoiding malfunctions.
Table 2: Organization of general notices
1 General information
The modules are equipped with 2 safe analog input pairs for current measurement. Each input pair has its own
sensor power supply. The channels with their respective sensor supplies are galvanically isolated from each other.
It is possible to acquire current signals in the range of 0.5 to 25 mA.
The safe analog input modules are suitable for safely acquiring current signals for safety-related applications up
to PL e or SIL 3.
These modules are designed for X20 16-pin terminal blocks.
•2 safe analog input pairs for current measurement 0.5 to 25 mA
•24-bit digital converter resolution
•Channels individually galvanically isolated
•Sensor power supplies galvanically isolated
•Input filter configurable

X20(c)SA4430
2 Data sheet V1.141 X20(c)SA4430 Translation of the original documentation
1.1 Function
Safe analog inputs
This safe analog input module is suitable for safely acquiring current signals for safety-related applications up to
PL e or SIL 3.
openSAFETY
This module uses the protective mechanisms of openSAFETY when transferring data to the various bus systems.
Because the data is encapsulated in the openSAFETY container in a fail-safe manner, the components on the
network that are involved in the transfer do not require any additional safety-related features. At this point, only
the safety-related characteristic values specified for openSAFETY in the technical data are to be consulted. The
data in the openSAFETY container undergoes safety-related processing only when received by the remote sta-
tion; for this reason, only this component is involved from a safety point of view. Read access to the data in the
openSAFETY container for applications without safety-related characteristics is permitted at any point in the net-
work without affecting the safety-related characteristics of openSAFETY.

X20(c)SA4430
Data sheet V1.141 X20(c)SA4430 Translation of the original documentation 3
1.2 Coated modules
Coated modules are X20 modules with a protective coating for the electronics component. This coating protects
X20c modules from condensation.
The modules' electronics are fully compatible with the corresponding X20 modules.
Information:
For simplification purposes, only images and module IDs of uncoated modules are used in this data
sheet.
The coating has been certified according to the following standards:
•Condensation: BMW GS 95011-4, 2x 1 cycle
•Corrosive gas: EN 60068-2-60, Method 4, exposure 21 days
Contrary to the specifications for X20 system modules without safety certification and despite the tests performed,
X20 safety modules are NOT suited for applications with corrosive gases (EN 60068-2-60)!
2 Overview
Module X20SA4430
Number of inputs 2x 2
Measurement range Up to firmware version 321: 3.6 to 21 mA, firmware version 322 or later: 0.5 to 25 mA
Digital converter resolution 24-bit
Note Electrical isolation between channels
Table 3: Safe analog input module
3 Order data
Model number Short description Figure
Analog input modules
X20SA4430 X20 safe current input module, 2x 2 safe analog inputs, 4 to
20 mA, channels individually galvanically isolated, configurable
input filter and switching thresholds
X20cSA4430 X20 safe current input module, coated, 2x 2 safe analog inputs,
4 to 20 mA, channels individually galvanically isolated, config-
urable input filter and switching thresholds
Required accessories
Bus modules
X20BM33 X20 bus module, for X20 SafeIO modules, internal I/O power
supply continuous
X20BM36 X20 bus module, for X20 SafeIO modules, with node number
switch, internal I/O power supply continuous
X20cBM33 X20 bus module, coated, for X20 SafeIO modules, internal I/O
power supply continuous
Terminal blocks
X20TB5F X20 terminal block, 16-pin, safety-keyed
Table 4: X20SA4430, X20cSA4430 - Order data

X20(c)SA4430
4 Data sheet V1.141 X20(c)SA4430 Translation of the original documentation
4 Technical data
Model number X20SA4430 X20cSA4430
Short description
I/O module 2x 2 safe analog inputs, 4 to 20 mA, channels individually galvanically isolated
General information
B&R ID code 0xB8B5 0xDD9F
System requirements
Automation Studio 3.0.81.15 or later 4.0.16 or later
Automation Runtime 3.00 or later V3.08 or later
SafeDESIGNER 2.81 or later 3.1.0 or later
Safety Release 1.4 or later 1.7 or later
Status indicators I/O function per channel, operating state, module status
Diagnostics
Module run/error Yes, using status LED and software
Inputs Yes, using status LED and software
Blackout mode
Scope Module
Function Module function
Standalone mode No
Max. I/O cycle time 2 ms
Power consumption
Bus 0.25 W
Internal I/O 1.7 W
Electrical isolation
Channel - Bus Yes
Channel - Channel Yes
Channel pair - Channel pair Yes
Certifications
CE Yes
KC Yes -
EAC Yes -
UL cULus E115267
Industrial control equipment
HazLoc cCSAus 244665
Process control equipment
for hazardous locations
Class I, Division 2, Groups ABCD, T5
ATEX Zone 2, II 3G Ex nA nC IIA T5 Gc
IP20, Ta (see X20 user's manual)
FTZÚ 09 ATEX 0083X
DNV GL Temperature: A (0 - 45°C)
Humidity: B (up to 100%)
Vibration: A (0.7 g)
EMC: B (bridge and open deck)
Functional safety cULus FSPC E361559
Energy and industrial systems
Certified for functional safety
ANSI UL 1998:2013
Functional safety IEC 61508:2010, SIL 3
EN 62061:2013, SIL 3
EN ISO 13849-1:2015, Cat. 4 / PL e
IEC 61511:2004, SIL 3
Functional safety EN 50156-1:2004
Safety characteristics
Note The following characteristic values apply only to the use of input channel pairs.
Assessing the channels from a safety point of view when they are used individually is not possible. 1)
EN ISO 13849-1:2015
Category Cat. 4 (SHUNTTEST enabled), Cat. 3 (SHUNTTEST disabled)
PL PL e (SHUNTTEST enabled), PL d (SHUNTTEST disabled)
DC >94% (regardless of whether SHUNTTEST is enabled or disabled)
MTTFD 2200 years (regardless of whether SHUNTTEST is enabled or disabled)
Mission time Max. 20 years
IEC 61508:2010,
IEC 61511:2004,
EN 62061:2013
SIL CL SIL 3 (regardless of whether SHUNTTEST is enabled or disabled)
SFF >90% (regardless of whether SHUNTTEST is enabled or disabled)
PFH / PFHd
Module <1*10-9 (regardless of whether SHUNTTEST is enabled or disabled)
openSAFETY wired Negligible
openSAFETY wireless <1*10-14 * Number of openSAFETY packets per hour
PFD <1*10-4 (regardless of whether SHUNTTEST is enabled or disabled)
Proof test interval (PT) 20 years
Table 5: X20SA4430, X20cSA4430 - Technical data

X20(c)SA4430
Data sheet V1.141 X20(c)SA4430 Translation of the original documentation 5
Model number X20SA4430 X20cSA4430
I/O power supply
Nominal voltage 24 VDC
Voltage range 24 VDC -15% / +20%
Analog inputs
Input type Differential input
Digital converter resolution 24-bit
Conversion time See chapter "I/O update time".
Output format SAFEINT
Load Up to hardware revision D3: 230 to 420 Ω, hardware revision E0 or later: 185 to 245 Ω
Input protection Protection against external supply voltages and overcurrent
Open-circuit detection Yes, using software
Permissible input signal
Voltage Max. 30.5 V
Conversion procedure Sigma-delta
Max. error at 25°C
Gain
0.5 to <4 mA <0.3% 2)
4 to 25 mA <0.08% 2)
Offset
0.5 to <4 mA <2 µA
4 to 25 mA <6.3 µA
Max. gain drift
0.5 to <4 mA <1.225 µA/°C
4 to 25 mA <1.225 µA/°C
Max. offset drift
0.5 to <4 mA <0.735 µA/°C
4 to 25 mA <0.735 µA/°C
Common-mode rejection
DC >70 dB
50 Hz >70 dB
Common-mode range Between the inputs ±50 V
Nonlinearity <0.003%
Measurement range Up to firmware version 321: 3.6 to 21 mA, firmware version 322 or later: 0.5 to 25 mA
Input filter
Hardware 1st-order low pass / cutoff frequency 500 Hz
Software Sinc3 filter
Resolution 1 µA/LSB
Overload detection Yes, using software
Test voltage between
Channel and bus 500 VDC
To ground 500 VDC
Channel pair and channel pair 500 VDC
Safety-related accuracy per channel
Cat. 3 0.184 mA
Cat. 4 0.49 mA
Filter time Configurable between 1 and 66.7 ms
Sensor power supply
Nominal voltage 29 VDC ±5%
Nominal output current Max. 60 mA
Short-circuit proof Yes, continuous
Electrical isolation
Sensor power supply - Channel No
Sensor power supply - Sensor power supply Yes
Behavior on short circuit Voltage cutoff
Operating conditions
Mounting orientation
Horizontal Yes
Vertical Yes
Installation elevation above sea level 0 to 2000 m, no limitation
Degree of protection per EN 60529 IP20
Ambient conditions
Temperature
Operation
Horizontal mounting orientation 0 to 60°C -40 to 60°C 3)
Vertical mounting orientation 0 to 40°C -40 to 40°C 4)
Derating See section "Derating".
Storage -40 to 85°C
Transport -40 to 85°C
Table 5: X20SA4430, X20cSA4430 - Technical data

X20(c)SA4430
6 Data sheet V1.141 X20(c)SA4430 Translation of the original documentation
Model number X20SA4430 X20cSA4430
Relative humidity
Operation 5 to 95%, non-condensing Up to 100%, condensing
Storage 5 to 95%, non-condensing
Transport 5 to 95%, non-condensing
Mechanical properties
Note Order 1x safety-keyed terminal block separately.
Order 1x safety-keyed bus module separately.
Spacing 25+0.2 mm
Table 5: X20SA4430, X20cSA4430 - Technical data
1) The related danger warnings in the technical data sheet must also be observed.
2) Based on the current measured value
3) Up to hardware upgrade <1.10.9.0: -25 to 60°C
4) Up to hardware upgrade <1.10.9.0: -25 to 40°C
Danger!
Operation outside the technical data is not permitted and can result in dangerous states.
Information:
For detailed information about installation, see chapter "Installation notes for X20 modules" on page
38.
Derating
Modules next to the X20SA4430 can only have a maximum power consumption of 1 W. Beginning at 50°C (hori-
zontal mounting orientation) and 35°C (vertical mounting orientation), a dummy module must be inserted next to
the X20SA4430.
Number of usable signal pairs
Horizontal mounting orientation up to 50°C 2
Horizontal mounting orientation up to 55°C 1
Vertical mounting orientation up to 35°C 2
Vertical mounting orientation from 35 to 40°C 1
Table 6: Derating in relation to operating temperature and mounting orientation
4.1 Safety-oriented measurement precision
The following aspects need to be taken into consideration with regard to the safety-oriented measurement precision
of a safe analog input module or temperature module:
•The safety-related precision per channel is specified in the technical data.
•The measurement precision of a signal is the result of: Safety-related precision of the channel + Measure-
ment precision of the sensor + Quality of the signal link of the sensor at the measurement point (depends
on the installation)
•From a safety standpoint, a channel pair (i.e. signal pair) must always be observed. The measure-
ment precision acquired for the signal pair must be taken into consideration when specifying the
"Limit Threshold Equivalent" parameter. The "Limit Threshold Equivalent" parameter must be set as small
as possible, but its value should not fall below the functional measurement precision.
•From a safety point of view, a guaranteed measurement precision per signal pair is the result of:
± ("Limit Threshold Equivalent" + Measurement precision of signal)

X20(c)SA4430
Data sheet V1.141 X20(c)SA4430 Translation of the original documentation 7
5 LED status indicators
Figure LED Color Status Description
Off No power to module
Single flash Reset mode
Double flash Updating firmware
Blinking PREOPERATIONAL mode
r Green
On RUN mode
Off No power to module or everything OK
Pulsating Boot loader mode
Triple flash Updating safety-related firmware
e Red
On Error or I/O component not provided with voltage
e + r Red on / green single flash Invalid firmware
Input state of the corresponding analog input
On Warning/Error on an input channel
Blinking Open circuit on corresponding channel
Red
All on Error on all channels, connection to the SafeLOGIC controller
not OK or booting not yet completed
On Channel being used and signal OK
Blinking Channel outside of the limits configured in SafeDESIGNER
1 to 4
Green
Off Channel not used
Input state of the corresponding analog input channel pair
On Warning/Error on this channel pairRed
All on Error on all channels, connection to the SafeLOGIC controller
not OK or booting not yet completed
On Signal on channel pair OK
12, 34
Green
Off Signal on channel pair not OK
Off RUN mode or I/O component not provided with voltage
1 s
Boot phase, missing X2X Link or defective processor
1 s
Safety PREOPERATIONAL state
Modules that are not used in the SafeDESIGNER application
remain in the PREOPERATIONAL state.
1 s
Safe communication channel not OK
1 s
The firmware for this module is a non-certified pilot customer
version.
1 s
Boot phase, faulty firmware
Red
On Safety state active for the entire module (= "FailSafe" state)
SE
The "SE" LEDs separately indicate the status of safety processor 1 ("S" LED) and safety processor 2
("E" LED).
Table 7: Status display
Danger!
Constantly lit "SE" LEDs indicate a defective module that must be replaced immediately.
It is your responsibility to ensure that all necessary repair measures are initiated after an error occurs
since subsequent errors can result in a hazard!

X20(c)SA4430
8 Data sheet V1.141 X20(c)SA4430 Translation of the original documentation
6 Pinout
V24+ 1
GND 1
V24+ 1
SAI+ 1
SAI- 1
SAI+ 2
GND 2
V24+ 2
SAI- 3
SAI+ 4
GND 2 SAI- 4
SE
34
12
e
4
3
2
1
r
X20 SA 4430
SAI- 2
SAI+ 3
GND 1
V24+ 2
Figure 1: X20SA4430 - Pinout

X20(c)SA4430
Data sheet V1.141 X20(c)SA4430 Translation of the original documentation 9
7 Connection examples
The typical connection examples in this section only represent a selection of the different wiring methods.
The following must be taken into consideration during installation:
•The line resistance must be added to the module's load.
•Make sure that long cables are laid neatly and properly.
•All wiring must be shielded.
•All installed wiring must provide short-circuit protection and voltage disturbance protection (fault exclusion
per EN ISO 13849-2:2012, appendix D.2.4, table D.4).
Information:
The analog inputs must be wired; otherwise, the module changes to state "FailSafe".
7.1 Channel pair applications with 2 sensors
The following channel pair applications are sufficient to achieve max. PL e (EN ISO 13849-1:2015), max. SIL 3
(EN 62061:2013), max. SIL 3 (IEC 61508:2010) or max. SIL 3 (IEC 61511:2004).
X20SA4430 - 2-wire connection, 2x SIL 2
I
GND
+24 VDC
GND
+24 VDC
SA
+
−
Sensor 1
SIL 2
+
−
Sensor 2
SIL 2
Safe Input pair 1
I
Figure 2: X20SA4430 - 2-wire connection, 2x SIL 2

X20(c)SA4430
10 Data sheet V1.141 X20(c)SA4430 Translation of the original documentation
X20SA4430 - 3-wire connection, 2x SIL 2
GND
+24 VDC
GND
+24 VDC
SA
Sensor 1
SIL 2
Sensor 2
SIL 2
Safe Input pair 1
I
+
-
I
+
-
Figure 3: X20SA4430 - 3-wire connection, 2x SIL 2
X20SA4430 - 4-wire connection, 2x SIL 2
GND
+24 VDC
GND
+24 VDC
SA
+
−
Sensor 1
SIL 2
+
−
Sensor 2
SIL 2
Safe Input pair 1
II
Figure 4: X20SA4430 - 4-wire connection, 2x SIL 2

X20(c)SA4430
Data sheet V1.141 X20(c)SA4430 Translation of the original documentation 11
7.2 Channel pair applications with only one sensor
The following channel pair applications are sufficient to achieve max. PL e (EN ISO 13849-1:2015), max. SIL 3
(EN 62061:2013), max. SIL 3 (IEC 61508:2010) or max. SIL 3 (IEC 61511:2004).
X20SA4430 - 2-wire connection, 1x SIL 3
I
GND
+24 VDC
GND
+24 VDC
SA
+
−
Sensor 1
SIL 3
Safe Input pair 1
Figure 5: X20SA4430 - 2-wire connection, 1x SIL 3
X20SA4430 - 3-wire connection, 1x SIL 3
GND
+24 VDC
GND
+24 VDC
SA
Sensor 1
SIL 3
Safe Input pair 1
I
+
-
Figure 6: X20SA4430 - 3-wire connection, 1x SIL 3

X20(c)SA4430
12 Data sheet V1.141 X20(c)SA4430 Translation of the original documentation
X20SA4430 - 4-wire connection, 1x SIL 3
GND
+24 VDC
GND
+24 VDC
SA
I
+
−
Sensor 1
SIL 3
Safe Input pair 1
Figure 7: X20SA4430 - 4-wire connection, 1x SIL 3

X20(c)SA4430
Data sheet V1.141 X20(c)SA4430 Translation of the original documentation 13
8 Error detection
8.1 Internal module errors
The red "SE" LED makes it possible to evaluate the following error states:
•Module error, e.g. defective RAM, defective CPU, etc.
•Overtemperature/Undertemperature
•Overvoltage/Undervoltage
•Incompatible firmware version
Errors that occur within the module are detected according to the requirements of the standards listed in the
certificate and within the minimum safety response time specified in the technical data. After this occurs, the module
enters a safe state.
The internal module tests needed for this are only performed, however, if the module's firmware has been booted
and the module is in either the PREOPERATIONAL state or the OPERATIONAL state. If this state is not achieved
(for example, because the module has not been configured in the application), then the module will remain in the
boot state.
BOOT mode on a module is clearly indicated by a slowly blinking SE LED (2 Hz or 1 Hz).
The error detection time specified in the technical data is relevant only for detecting external errors (i.e. wiring
errors) in single-channel structures.
Danger!
Operating the safety module in BOOT mode is not permitted.
Danger!
A safety-related output channel is only permitted to be switched off for a maximum of 24 hours. The
channel must be switched on by the end of this period so that the module's internal channel test can
be performed.

X20(c)SA4430
14 Data sheet V1.141 X20(c)SA4430 Translation of the original documentation
8.2 Wiring errors
The wiring errors described in the following section are indicated by the red channel LED according to the appli-
cation.
If a module detects an error, then:
•The channel LED is lit constantly red.
•Status signal (e.g. (Safe)ChannelOK, (Safe)InputOK, (Safe)OutputOK, etc.) is set to (SAFE)FALSE.
•Signal "SafeDigitalInputxx" or "SafeDigitalOutputxx" is set to SAFEFALSE.
•An entry is generated in the logbook.
Danger!
Recognizable errors are detected by the module within the error detection time. Errors not recognized
by the module (or not recognized on time) that can lead to safety-critical states must be detected using
additional measures.
Danger!
It is your responsibility to ensure that all necessary repair measures are initiated after an error occurs
since subsequent errors can result in a hazard!
Errors Detection Comment
Open line Detected Module switches to the FAILSAFE state
Short circuit between T+ or T- and external 24
V or GND
Not detected Signal distortion usually does not result due to the electrical isolation of the channels;
nevertheless, it is mandatory to use shielded signal lines.
The user must take appropriate measures to ensure that this error does not lead to a
safety-critical state.
Signal and supply lines must be installed in such a way that fault exclusion is possible
per EN ISO 13849-2:2012, table D.5.
Short circuit between T+ and T- Not detected This error results in signal distortion that may be detected by dual-channel evaluation in
some circumstances.
The user must take appropriate measures to ensure that this error does not lead to a
safety-critical state.
Signal and supply lines must be installed in such a way that fault exclusion is possible
per EN ISO 13849-2:2012, table D.5.
Reverse polarity of T+ and T- Not detected This error results in signal distortion that may be detected by dual-channel evaluation in
some circumstances.
The user must take appropriate measures to ensure that this error does not lead to a
safety-critical state.
Signal and supply lines must be installed in such a way that fault exclusion is possible
per EN ISO 13849-2:2012, table D.5.
Disturbance voltage Not detected This error results in signal distortion that may be detected by dual-channel evaluation in
some circumstances.
Shielded cables are mandatory for all signal lines.
Different installation paths must be used for the cabling of both signals of the signal pair.
The user must take appropriate measures to ensure that this error does not lead to a
safety-critical state.
Table 8: Error detection for safe inputs of type "Thermocouple"
Errors Detection Comment
Open circuit on Sense+ or Sense- Detected Channel errors
Short circuit between Sense+, Sense- and ex-
ternal 24 V or GND
Not detected Signal distortion usually does not result due to the electrical isolation of the channels;
nevertheless, it is mandatory to use shielded signal lines.
The user must take appropriate measures to ensure that this error does not lead to a
safety-critical state.
Signal and supply lines must be installed in such a way that fault exclusion is possible
per EN ISO 13849-2:2012, table D.5.
Short circuit between Sense+ and Sense- Detected Channel errors
Disturbance voltage Not detected This error results in signal distortion that may be detected by dual-channel evaluation in
some circumstances.
Shielded cables are mandatory for all signal lines.
Different installation paths must be used for the cabling of both signals of the signal pair.
The user must take appropriate measures to ensure that this error does not lead to a
safety-critical state.
Table 9: Error detection for safe inputs of type "PT100 / PT1000"

X20(c)SA4430
Data sheet V1.141 X20(c)SA4430 Translation of the original documentation 15
Errors Detection Comment
Open line Detected Channel errors
Short circuit between signal lines May not be detected The user must take appropriate measures to ensure that this error does not lead to a
safety-critical state.
Signal and supply lines must be installed in such a way that fault exclusion is possible
per EN ISO 13849-2:2012, table D.5.
Short circuit between signal and supply line May not be detected The user must take appropriate measures to ensure that this error does not lead to a
safety-critical state.
Signal and supply lines must be installed in such a way that fault exclusion is possible
per EN ISO 13849-2:2012, table D.5.
Reverse polarity of signal lines Detected Module switches to the FAILSAFE state
Disturbance voltage Not detected This error results in signal distortion that may be detected by dual-channel evaluation in
some circumstances.
Shielded cables are mandatory for all signal lines.
Different installation paths must be used for the cabling of both signals of the signal pair.
The user must take appropriate measures to ensure that this error does not lead to a
safety-critical state.
Table 10: Error detection for safe inputs of type "Current"
8.3 Signal errors
"HW_LIMIT_MIN" designates the lower limit of the measurement range specified in the technical data.
"HW_LIMIT_MAX" designates the upper limit of the measurement range specified in the technical data.
A reset must be performed in order to leave an error state.
For this to be possible, a valid signal must be received at the analog input for the duration of the I/O update time.
Then the error can be acknowledged by a rising edge on signal "SafeRelease0x0y".
Signal evaluation takes place in 3 stages:
Stage 1: Evaluation of signals against absolute limits
SafeRelease0x0y
Compare
AND
Compare
ChannelOK0x
(
(
input_signal_x >
HW_LIMIT_MIN
input_signal_x <
HW_LIMIT_MAX
P
S
ChannelOK0x
(
(
NOT R
Stage 2: Evaluation of signals against configurable limits
ChannelOK0x
Compare
AND
AND
CurrentOK0x
Compare
input_signal_x >
input_signal_x <
Limit_Threshold_Low
Limit_Threshold_High
SafeRelease0x0y
(
(
P
S
CurrentOK0x
(
(
NOT R
Stage 3: Evaluation of signals against configurable signal pair limits
CurrentOK0x
CurrentOK0y
Compute
TOF
AND
CurrentOK0x0y
IN
PT
Q
ET
ABS(input_signal_x -
input_signal_y) <
Limit_Threshold_Equivalent
Discrepancy_Time_ms
SafeRelease0x0y
(
(
P
S
CurrentOK0x0y
(
(
NOT R

X20(c)SA4430
16 Data sheet V1.141 X20(c)SA4430 Translation of the original documentation
8.4 Channel diagnostics
Channel electronics are automatically tested internally by the module. Here, a test signal is generated in the module
and applied to each channel once per hour for a maximum time of 1 s. To avoid signal distortion, the signal value
of the channel being tested is frozen during this time.
Only one channel is tested at a time. Per IEC 61508:2010, the module is considered a 1oo2D system for the
duration of the channel test. The resulting probability of a dangerous state was taken into account in the safety
characteristics in chapter 5.
Up to firmware version 321, the behavior for the duration of channel diagnostics is structured as follows:
The safe analog input channels (data type SAFEINT) are formed by the arithmetic mean value of the two individual
signals. Since the signal value of the channel being tested is frozen for the duration of channel diagnostics, the
arithmetic mean value during this period of channel diagnostics for the safe signal is taken from the frozen value
of the diagnosed channel and the signal value of the non-diagnosed channel.
In firmware version 322 and later, the behavior for the duration of channel diagnostics is structured as
follows:
The safe analog input channels (data type SAFEINT) are formed by the arithmetic mean value of the two individual
signals. For the duration of channel diagnostics, however, it is not the arithmetic mean value that is used, but the
signal value of the channel that is not currently being diagnosed.
If the behavior of firmware version 321 is desired for compatibility reasons, this can be implemented using para-
meter "Measurement Result while Testing = Averaged".
An active channel test is indicated by channel "TestActive".
The sequence for channel diagnostics is independent of the firmware version and structured as follows:
X20SA4430 X20ST4492
Diagnostic Window 1 Hourly SAI1 TC1, Sense 1
Diagnostic Window 2 Hourly, 15 min after Diagnostic
Window 1
SAI3 TC4, Sense 2
Diagnostic Window 3 Hourly, 30 min after Diagnostic
Window 1
SAI4 TC3
Diagnostic Window 4 Hourly, 45 min after Diagnostic
Window 1
SAI2 TC2
Table 11: Channel diagnostics sequence
In order to meet the stringent requirements of Cat. 4 per EN ISO 13849-1:2015, the shunts of the channel electronics
must be tested (shunt test) despite the multi-channel structure. For a proper shunt test, the slew rate of the input
signals must be limited to 220 μA/ms.
For steeper signal edges and parameter configuration "Disable Shunttest = No", the module switches to state
FAILSAFE if necessary, which affects the entire module. Note that very noisy signal sources or signals with high
frequencies likewise result in excessively steep signal edges and can trigger a shunt test error.
Information:
If problems with the slew rate of input signals or shunt test occur, the shunt test can be disabled with
parameter "Disable Shunttest = Yes-ATTENTION". In this context, note that the module meets only the
requirements of Cat. 3 per EN ISO 13849-1:2015.

X20(c)SA4430
Data sheet V1.141 X20(c)SA4430 Translation of the original documentation 17
9 Module function
The safe analog input module is suitable for safely acquiring current signals for safety-related applications up to
PL e or SIL 3.
Danger!
Possible failure of safety function
Dangerous system behavior due to incorrect use of analog signal values
When using analog signal values, note the information listed in the data sheet regarding the function-
ality, precision and scope of the data.
The current drawn via the input terminals is converted into measurement voltages via shunts 1 and 2, smoothed by
the hardware filters (1st-order low pass / cutoff frequency 500 Hz) and digitized in the subsequent A/D converters.
The filter values configured in the software are applied during digitalization in the A/D converter.
The signals then pass through the 3 stages of digital signal processing.
The safe analog input channels (data type SAFEINT) are formed by the arithmetic mean value of the two individual
signals. At this point, also note the information about channel diagnostics.
The validity of analog signals is represented by the associated status signals. These binary status signals (data
type SAFEBOOL) must also be evaluated each time the analog signals are used. A binary status signal with the
status FALSE indicates an invalid value in the analog signal. In these situations, the analog signal is no longer
permitted to be used for safety-related assessments.
To exit an error state, a reset must be carried out. For this to be possible, a valid signal must be received at the
analog input for the duration of the I/O update time. The error can then be acknowledged by a rising edge on signal
"SafeRelease0x0y".
An optional sensor power supply is available to provide power to the sensors. If the sensor is supplied externally,
the 2-wire connection examples must be used. Current measurement protects the module's internal sensor power
supply against overload.

X20(c)SA4430
18 Data sheet V1.141 X20(c)SA4430 Translation of the original documentation
10 Input circuit diagram
Sensor power supply 1 +
Sensor power supply 1 -
Channel 2 -
Channel 2 +
Channel 1 +
Channel 1 -
Galvanic isolation
Shunt 1
Shunt 2
1
Shunt 1
Shunt 2
2
Shunt
2
Sensor power supply 2 +
Sensor power supply 2 -
Channel 4 -
Channel 4 +
Channel 3 +
Channel 3 -
Galvanic isolation
Galvanic isolation
Shunt
4
Shunt 1
Shunt 2
3
Shunt 1
Shunt 2
4
Hardware
filter
Hardware
filter
Current
measurement
Hardware
filter
Hardware
filter
Current
measurement
A/D
converter 1
A/D
converter 2
A/D
converter 3
A/D
converter 4
DC-to-DC
29 V
DC-to-DC
29 V
Figure 8: Input circuit diagram

X20(c)SA4430
Data sheet V1.141 X20(c)SA4430 Translation of the original documentation 19
11 Minimum cycle time
The minimum cycle time specifies the time up to which the bus cycle can be reduced without communication errors
occurring.
Minimum cycle time
200 μs
12 I/O update time
The time needed by the module to generate a sample is specified by the I/O update time.
Danger!
With regard to the I/O update time, an I/O update time of 200 ms should generally be considered for
analog input modules with firmware version 301 or lower. The maximum I/O update time is 400 ms.
The I/O update time has been optimized in firmware version 302 and later. The optimized times are
listed in the table for the maximum I/O update time.
Configured filter Maximum I/O update time
1 ms 17 ms
2 ms 19 ms
10 ms 35 ms
16.7 ms 50 ms
20 ms 55 ms
33.3 ms 82 ms
40 ms 95 ms
66.7 ms 122 ms

X20(c)SA4430
20 Data sheet V1.141 X20(c)SA4430 Translation of the original documentation
13 Restart behavior
Each digital input channel is not equipped with an internal restart interlock, which means that the associated channel
data reverts back to the proper state automatically after an error situation on the module and/or network.
It is the responsibility of the user to connect the channel data of the safe input channels correctly and to provide
them with a restart interlock. The restart interlocks of PLCopen function blocks can be used here, for example.
Using input channels without a correctly connected restart interlock can result in an automatic restart.
Each output channel is equipped with an internal restart interlock, which means that the following sequence must
be followed in order to switch on a channel after an error situation on the module/network and/or after ending the
safety function:
•Correct all module, channel or communication errors.
•Enable the safety-related signal for this channel (SafeOutput, etc.).
•Pause to ensure that the safety-related signal has been processed on the module (min. 1 network cycle).
•Positive edge on the release channel
For switching the release signal, the notes for manual reset function in EN ISO 13849-1:2015 must be observed.
The restart interlock functions independently of the enabling principle, which means that the behavior described
above is not influenced by the parameter settings for the enabling principle or by the chronological position of the
functional switching signal.
An automatic restart of the module can be configured by setting parameters. With this function, the output channel
can be enabled using safety technology without an additional signal edge on the release channel. This function
remains active as long as the release signal is TRUE and there is no error situation on the module/network.
Regardless of this parameter, a positive edge is required on the release channel for enabling the output channel
in the following situations:
•After switching on
•After correcting an error on the safe communication channel
•After correcting a channel error
•After the release signal drops out
The automatic restart is configured in SafeDESIGNER using the channel parameters. If using an automatic restart,
note the information in EN ISO 13849-1:2015.
Danger!
Configuring an automatic restart can result in critical safety conditions. Take additional measures to
ensure proper safety-related functionality.