HIMA HIQuad X Series Safety Programmable Electronic System (PES)

HIMA HIQuad X Series Safety Programmable Electronic System (PES)

HIQuad X is an innovative high-performance safety programmable electronic system launched by HIMA, developed based on the mature HIQuad system. The system adopts a modular design and is programmed, configured, monitored, operated, and document managed through the validated programming tool SILworX of HIMA, ensuring the future compatibility of all HIMA programmable systems. HIQuad X supports existing HIQuad I/O modules to protect users' upfront investments.

The HIQuad X system consists of two major system families: H51X and H41X, which can use the same modules but have structural differences. The H51X system consists of a basic rack (excluding I/O modules) and up to 16 expansion racks, supporting up to 256 I/O modules; The H41X system consists of a basic rack (up to 12 I/O modules) and an expansion rack, supporting up to 28 I/O modules. This flexible structural design enables HIQuad X to adapt to various safety control application requirements ranging from small to large.

System Concept and Security Architecture

2.1 Security and usability design

The HIQuad X system is designed for safety related applications up to SIL 3 level, compliant with the IEC 61508 standard, and can be used for both "power-off trip" and "power on trip" safety principles simultaneously. The basic rack must be equipped with a safety related processor module F-CPU 01, which uses a 1002 processor system and includes two microprocessors that continuously align data to ensure that a single processor failure does not result in the failure of safety functions.

The security signal processing path of the system is as follows:

Input module security records sensor measurement values

Exchange data between I/O processing module and processor module

The processor module cyclically queries the measurement values and processes them by the user program

The processing results are written into the output module through the I/O processing module, controlling the on-site actuators

2.2 H51X System Architecture

The H51X system adopts a modular structure, including one H51X basic rack and up to 16 expansion racks. The basic rack can be configured as follows:

2 processor module slots

Up to 10 communication modules

The expansion rack is connected through the RJ-45 system bus interface at the rear

Single system operation: Only use the processor module for signal processing in slot 8 (system bus A). If the system bus connection is interrupted, all I/O modules after the interruption point will no longer be available, and the output modules will enter a safe power-off state.

Redundant system operation: using two processor modules and two system buses significantly improves system availability. When a processor module fails, it automatically enters a safe state, and redundant processor modules maintain safe operation. The faulty processor module can be replaced during system operation.

2.3 H41X System Architecture

The H41X system includes a H41X base rack and an optional expansion rack for creating redundant I/O structures. Basic rack configurable:

2 processor module slots

Up to 2 communication modules

The I/O processing module F-IOP 01 is located in slot 13, connecting the I/O bus and the system bus

Single system operation: Only use the processor module for signal processing in slot 16 (system bus A). The expansion rack can be connected to system bus A through I/O processing modules.

Redundant system operation: using two processor modules and two system buses significantly improves availability. The expansion rack is connected to system buses A and B through I/O processing modules.

2.4 Expansion Rack

The expansion rack F-BASE RACK 11 allows the HIQuad X system to be equipped with up to 265 I/O modules. Each expansion rack can accommodate up to 16 I/O modules (slots 1-16). The I/O processing module F-IOP 01 is used to connect the system bus and the I/O bus. The power distribution module F 7133 is used for fusing and distributing L+and L - of I/O modules, with fuse monitoring function, indicating fuse faults through contacts and LEDs.

Core module functions

3.1 F-CPU 01 processor module

The processor module contains the CPU operating system and controls multiple user programs running in the module. The main tasks include:

Control the loop running of user programs

Self testing of executing modules

Control safety related communication through SafeEthernet

Redundancy (synchronization) of management processor modules

Operating system status:

LOCKED: Processor module reset to factory settings

STOP/VALID CONFIGURATION: Processor stopped, valid configuration in memory

STOP/INVALID CONFIGURATION: Processor stopped, no valid configuration in memory

RUN: The user program is running

RUN/UP STOP: User program not running, used for testing input/output and communication

3.2 F-IOP 01 I/O Processing Module

The I/O processing module manages the I/O bus of the H41X basic rack and expansion rack, used to exchange process data between I/O modules and I/O processing modules. The main tasks include:

Exchange data with processor modules through system bus A and system bus B

Provide watchdog signal to the output module

3.3 F-COM 01 Communication Module

The communication module is equipped with 2 Ethernet interfaces and 1 fieldbus interface, allowing the HIQuad X system to communicate with external systems. This module is approved for use in safety related HIQuad X systems and can transmit safety related protocols.

3.4 I/O module

HIQuad X supports multiple digital and analog I/O modules, including:

Digital input modules: F 3221, F 3224A, F 3236, F 3237, F 3238, F 3240, F 3248

Digital output modules: F 3322, F 3325, F 3330, F 3331, F 3333, F 3334, F 3335, F 3349, F 3422, F 3430

Counter module: F 5220

Analog input modules: F 6215, F 6217, F 6220, F 6221

Analog output module: F 6705, F 6707

System bus and communication

4.1 System Bus

The HIQuad X system is based on redundant system buses A and B. Each system bus is controlled by a processor module in the base rack. During redundant operation, two system buses communicate simultaneously. The system bus connects the RJ-45 interface and I/O processing module at the rear of the basic rack. The maximum distance between two system bus users is 50 meters.

Important precautions:

Do not interconnect the system bus of multiple HIQuad X systems

The system bus connector shall not be used as a regular Ethernet connection

It is necessary to use jumper cables that comply with the industrial standard Cat. 5e or better

4.2 I/O bus

All I/O modules are connected to the I/O processing module through the I/O bus. The I/O processing modules in the H41X basic rack (slot 13) and expansion rack (slot 17) connect the I/O bus to the system bus.

4.3 I/O watchdog

The safety related system requires a second independent shutdown option, which is ensured by the I/O watchdog signal. The I/O processing module controls, monitors, and applies I/O watchdog signals to the output module. The output module only operates when the watchdog signal is present (high level). If the I/O watchdog signal is turned off, the output module safely enters a power-off state.

4.4 Noise Suppression

The noise suppression function can suppress transient interference and improve system availability. Noise suppression can be activated for I/O modules. If interference is suppressed, the system automatically processes the last valid input and output values. The time for suppressing interference is limited by safety time, watchdog time, and cycle time.

Formula for calculating the maximum noise suppression time:

text

Maximum noise suppression time=safe time - (2 x watchdog time)

Redundant design

The conceptual design of the HIQuad X system is characterized by high availability, and all system components can operate redundantly. Redundant systems only improve system availability, but do not increase their security integrity level.

5.1 Redundancy of processor modules

The HIQuad X system can be configured as a single system with only one processor module, or as a high availability redundant system with two redundant processor modules.

Reduce redundancy: If one of the processor modules is unavailable, the system continues to operate safely.

Add redundancy: If a new processor module is added to the running HIQuad X system, it will automatically synchronize with the configuration of the existing processor module. Requirements: User program redundancy configuration, unused redundant processor module slots, and at least one system bus running.

5.2 I/O module redundancy

Module redundancy: Two I/O modules of the same type can be combined into a redundant group in the SILworX hardware editor and must be inserted into different racks

Channel redundancy: Only channels with the same channel number can be defined as redundant channels

5.3 System bus redundancy

The HIQuad X system can operate using redundant system buses A and B. Redundant operation requirements: Each basic rack uses 2 processor modules, corresponding configurations in programming tools, and rack connections are correct.

5.4 Communication redundancy

The redundant configuration of safeEthernet communication connections is completed in the SILworX safeEthernet editor.

Programming and Variable Management

6.1 Variable Types and Initial Values

SILworX supports multiple variable types, including VAR, VAR_GLOBAL, VAR-INPUT, VAR-OUTPUT, and more. An initial value can be assigned to any variable, and the variable will use this value when no other values are assigned.

HIMA recommends assigning safe values as initial values to all variables that receive values from physical inputs or communications! The default value for variables that have not been assigned an initial value is 0 or False (for BOOL type variables).

6.2 System Variables and System Parameters

System variables are predefined variables used in user programs to handle HIQuad X system properties or states. System parameters are used to configure the properties of the controller.

Resource system parameters (partial):

System ID [SRS]: System ID, a unique value in the network

Safety Time [ms]: Safety time, range 20-22500 ms

Watchdog Time [ms]: Watchdog time, range 6-7500 ms

AutoStart: Does the user program automatically start when connected to the power supply

Global Forcing allowed: Is global forcing allowed

6.3 Mandatory Function

Forcing is the process of replacing the current value of a variable with a forced value, used to test user programs or simulate unavailable sensors. Mandatory can run at two levels:

Global forcing: All global variables of the application are forced

Local forcing: The local variable values of a single user program are forced

Time limit: Different time limits can be enforced globally or locally. After the time expires, the controller stops forcing values.

Security Warning:

Mandatory testing can only be carried out after obtaining the consent of the testing agency responsible for acceptance testing

Forcing values may result in incorrect output values

Forcing an extension of the cycle time may result in the watchdog time exceeding the limit

6.4 User Management

The user management in SILworX can set user groups, user accounts, and their access permissions for each project and controller

PADT User Management: Control Access to SILworX Project

PES User Management: Control Access to PES

HIMA recommends using user management to protect SILworX projects and controllers from unauthorized access and network attacks.

Diagnostic system

7.1 LED indicator light

The LED indicator light on the front panel displays the status of the module, and all LEDs should be considered comprehensively. After connecting to the power supply, perform an LED test and ensure that all LEDs light up for at least 2 seconds.

7.2 Diagnostic History

The F-CPU, F-IOP, and F-COM modules store the diagnostic history of faults and other events that have occurred, in chronological order.

Module type Long term diagnosis Maximum number of events Short term diagnosis Maximum number of events

F-CPU 01 2500 1500

F-IOP 01 400 500

F-COM 01 300 700

7.3 Online Diagnosis

The online view in SILworX hardware editor is used to diagnose faults in HIQuad X modules. The faulty module is represented by color changes:

Red: Serious malfunction, such as module not inserted

Yellow: Less severe faults, such as exceeding temperature limits

Lifecycle Management

8.1 Installation Requirements

Grounding: HIMA control cabinets must use large-area functional grounding connections

Shielding: The on-site cables of sensors and actuators must be continuously shielded and grounded at both ends

Surge protection: For digital inputs, shielded input lines or noise suppression in user programs can be used

8.2 Startup steps

Connect to power

Set the system ID and IP address of F-CPU 01 on the left side

Connect the basic rack and expansion rack

Set the mode switch of the left processor module to Stop

login system

Set the mode switch of the right processor module to Stop

Download configuration

Set the mode switch of all processor modules to Run

Execute resource cold start

8.3 Maintenance

HIMA recommends regular replacement of controller fans

Security related applications must undergo regular verification testing

Operating system updates can be loaded into modules through SILworX