HIMA HIMatrix series compact safety controller

The processor system collects events and stores them in a buffer. A buffer is a part of non-volatile memory with a capacity of 1000 events. If the event buffer is full, new events cannot be stored until they are read and marked as overwritten.

The X-OPC server reads events from the buffer and transfers them to third-party systems for evaluation or notification. Up to 4 X-OPC servers can simultaneously read events from one processor module.

Communication system

6.1 Ethernet and Integrated Switches

The HIMatrix controller and remote I/O are equipped with Ethernet switches with RJ-45 connectors, which can be used to connect other devices. Switches have the following characteristics:

Automatically learn and generate address/port allocation tables

Automatically switch between 10 and 100 MBit/s transmission rates

Automatically switch between full duplex and half duplex connections

The 'automatic crossover' function can recognize crossed cables and automatically adjust them

6.2 SafeEthernet Security Protocol

SafeEthernet is a transmission protocol based on Ethernet technology used to transmit safety related data up to SIL 3 level. It implements the following fault detection and safety response mechanisms:

Data transmission corruption (duplicate, lost, and altered bits)

Invalid message addressing (sender, receiver)

Incorrect data sequence (duplicate, lost, swapped)

Invalid timing (delay, echo)

SafeEthernet adopts the black channel method, uses insecure data transmission channels (Ethernet), and monitors both the sender and receiver through security related protocol mechanisms. This allows users to use common Ethernet network components such as hubs, switches, and routers in security related networks.

Warning: Operators are responsible for ensuring that the Ethernet used for SafeEthernet is adequately protected to prevent manipulation. The type and scope of measures must be jointly agreed upon with the responsible testing agency.

6.3 Communication with PADT

The HIMatrix controller communicates with PADT (programming and debugging tool) via Ethernet. PADT is a computer with programming tools (SILworX or ELOP II Factory) installed. Programming tools must be compatible with the operating system version of the controller:

Version 7 and above using SILworX

Use ELOP II Factory for versions 7 and below

A controller can communicate with up to 5 PADTs simultaneously. At this point, only one programming tool can have write access to the controller, while the others can only read information.

Operating System and User Programs

7.1 Processor Operating System Functions

The operating system includes all the basic functions of the HIMatrix controller. The application functionality is specified by the user program. The code generator converts the user program into machine code, and the programming tool transfers this machine code to the controller's flash memory.

7.2 Fault response behavior

Permanent input/output faults:

The fault channel does not affect the overall controller, and the operating system only considers the fault channel as a fault

Fault input channel: The operating system sends a safe value of 0 or an initial value for processing

Fault output channel: The operating system sets it to a power-off state

If the I/O module failure persists for more than 24 hours, the controller will permanently shut down the affected I/O module

Temporary input/output faults:

After the fault disappears on its own, the operating system resets the fault state and resumes normal operation

The operating system calculates and evaluates the frequency of faults, and if the specified fault frequency is exceeded, the module status will be permanently set to fault

Internal malfunction:

Processor operating system version V.6.44 and above: HIMatrix controller automatically starts. If an internal fault is detected again within one minute after startup, the controller will remain in STOP/INVALID CONFIGURATION state.

7.3 Operating Mode of Processor System

Operating mode description

The secure state of the Initiate processor system during the initialization phase, performing hardware and software testing

STOP/VALID CONFIGURATION processor system security status, not executing user programs, all outputs reset

STOP/INVALID CONFIGURATION is a safe state after no configuration loading or system failure, and can only be restarted through PADT

RUN processor system activity, user program loop running, I/O signal processing

7.4 Multi tasking - with L3

Multi tasking refers to the ability of the HIMatrix system to process up to 32 user programs within a processor module. This allows the sub functions of the project to be separated from each other. Each user program can start, stop, and load independently, including execution through overload functionality.

Key parameters:

Maximum duration per cycle [μ s]: The time allowed to execute user programs within a CPU cycle

Program ID: The ID used to identify the program when displayed in SILworX

Watchdog time: Resource watchdog time

Target cycle time [ms]: required or maximum cycle time

Multi tasking mode: a way to use unused execution time of user programs

Multi task processing mode: