HIMA HIMax Safety Related Controller System

HIMA HIMax Safety Related Controller System

Core hardware structure of the product

(1) Hardware composition

X-BASE PLATE: Core hardware carrier, divided into 10 slots (X-BASE PLATE 10 01), 15 slots (15 01/15 02), and 18 slots (18 01). Substrate 0 is mandatory and can expand up to 15 substrates (a total of 16). Each slot can accommodate 1 module and 1 connection board;

Core module:

Processor module (X-CPU 01): up to 4, supports redundant operation, slots 3-6 (board 0) and 3-4 (board 1) are designated installation slots;

System bus module (X-SB 01): 2 per substrate (Slot 1-2), managing dual redundant system buses A/B;

I/O module: digital/analog/counter type, supports 32/64 channels, some with event logging (SOE) function;

Communication module (X-COM 01): supports protocols such as safeEthernet, Modbus, PROFIBUS, etc;

Heat dissipation and power supply:

Heat dissipation: X-FAN system fans (2-4 per substrate) need to be installed above the substrate to ensure that hot air is discharged;

Power supply: Dual redundant 24VDC input, substrate terminals L1+/L1-, L2+/L2-, each module supports voltage decoupling.

(2) System Bus and Expansion

Dual redundant system bus (A/B): based on Ethernet technology, supporting Cat.5 (100Mbit/s) and Cat.6 (1Gbit/s) cables, with a maximum delay of 50 µ s during fiber optic expansion;

Scalability:

Maximum expansion distance: 19.6km (when processors are centrally arranged), maximum distance between processors is 1.8km;

Substrate interconnection: Through RJ-45 interface, UP/DOWN ports are cascaded, and cross connection of system bus A/B is prohibited.

Redundancy mechanism (high availability core)

HIMax improves availability through full link redundancy design, with the following redundant objects and rules:

Key characteristics of redundant object implementation methods

1-4 redundant configurations of processor modules, supporting seamless takeover when adding/removing faults online, and supporting degraded operation

I/O module module level (2-3 layers) and channel level redundancy can be configured with "backup modules", and faults will not trigger alarms

Dual bus parallel operation of the system bus, independent physical path, single bus failure does not affect system operation

Communication SafeEthernet dual path, standard protocol requires user program management for secure communication delay configurable

Dual 24VDC power supply, module internal decoupling automatically switches in case of single power failure

Programming and Configuration (Based on SILworX Tool)

(1) Core programming functions

Supports up to 32 user programs to run in parallel, with configurable priority and task cycles;

Variable type: global/local/temporary variable, supports CONST (constant) and RETAIN (power down hold) attributes, and the initial value needs to be set to a safe value;

Multi tasking mode:

Mode 1: Shorten CPU cycles based on actual execution time;

Mode 2: High priority programs occupy low priority redundancy time (recommended high availability scenarios);

Mode 3: Fixed cycle operation, waiting for redundancy time to run out;

Event Recording (SOE): Supports Boolean (state change) and scalar (threshold over limit) events, with a buffer capacity of 5000 entries and millisecond timestamps, which can be exported through X-OPC servers.

(2) Loading and Updating

Download: Shutdown to load new configuration, controller needs to be in STOP state;

Reload: Reload modified configurations online without interrupting safe operation, supporting scenarios such as logic modification and variable reallocation;

Operating system update: Supports module level OS upgrade, which needs to be executed in the order of "I/O module → communication module → system bus module → processor module".

(3) Variable forcing (debugging function)

Support global/local variable forcing, with time limits that can be set (automatically canceled upon timeout);

Security restrictions: The forced function can be disabled through the key switch, and only authorized personnel can operate it. Forced operation may prolong the cycle time, and needs to be evaluated in advance.

User management and permission control

(1) Project level management (SILworX project)

Permission types: Security Administrator (Sec Adm, modifiable user management), Read/Write (R/W, full function operation), Read Only (RO, view only);

Configuration restrictions: Up to 100 user groups and 1000 user accounts, account names/passwords are case sensitive.

(2) Controller level management (PES)

Up to 10 user accounts, with permissions divided into 3 categories:

Read only: only view controller status;

Read and write: programming, loading, testing;

Administrator: Modify key configurations such as IP, SRS, operating system, etc;

Default account: Administrator (no password), first use requires modification.

Diagnosis and maintenance

(1) Diagnostic method

LED indicator lights: 11 types of indicator lights (module status/redundancy/fault/communication, etc.), supporting different flashing frequencies to distinguish states (such as Blinking1: 600ms on/600ms off);

Diagnostic history: Each module stores short-term (fault/event) and long-term (configuration change) logs, with a maximum of 2500 long-term logs for the processor module;

Online diagnosis: SILworX online view displays module status (red=serious fault, yellow=minor fault), supports tooltip to view SRS, connection status and other details.

(2) Maintenance requirements

Regular maintenance: The fan should be replaced every 6 years (at room temperature<40 ℃) or every 3 years (at high temperature>40 ℃); Regular functional testing is required (refer to the Safety Manual);

Fault handling: When a redundant module fails, it will automatically take over. If a non redundant module fails, it needs to be shut down for replacement. The faulty module is only authorized for maintenance by HIMA;

ESD protection: ESD wristbands should be worn during maintenance, and unused modules should be stored in anti-static packaging.

Installation and Startup

(1) Installation specifications

Grounding: L - Single point grounding, grounding resistance ≤ 2 Ω, all components of the cabinet are connected to equipotential through a 16/25mm ² yellow green grounding wire;

Cable: The power line and signal line are arranged separately, and shielded wires are used for analog signals. The shielding layer is grounded at one end;

Heat dissipation: Adequate space should be reserved around the substrate, and blank modules should be installed in unused slots to ensure ventilation.

(2) Start the process

Configure the Rack ID of the substrate (set through the system bus module, safety critical parameters);

Connect SILworX tool, set module IP address and SRS identifier;

Load project configuration (Download/Reload);

Switch the processor module mode switch to Run, and the system will automatically enter the running state;

Verify the diagnostic indicator light: The Run light is always green and the Error light is off, indicating a normal state.

Key specification parameters

Category specific indicators

Hardware scale up to 16 substrates, 4 processor modules, 6400 I/O channels

The maximum storage capacity for each user program is 32KB, and the maximum number of global variables is 523776

SafeEthernet communication has a maximum of 255 connections and a buffer of 1100 bytes

The maximum extension distance of the system bus is 19.6km (fiber optic), and the maximum distance between processors is 1.8km

The minimum cycle time can be configured to 0ms, and the watchdog time is 6-7500ms