HIMA HIMax Safety Related Controller System

HIMA HIMax Safety Related Controller System

HIMax is a high-performance safety related control system launched by HIMA, designed to meet the stringent requirements of continuous operation and maximum availability in the process industry. The system adopts a modular design, distributing core functions such as processing, input/output, and communication on pluggable modules. Users can flexibly configure customized controllers by selecting appropriate modules and baseboards according to specific application needs. The HIMax system can support safety applications up to SIL 3 level, comply with IEC 61508 standard, and can be used in situations that comply with EN 954-1 Cat.4 and ISO 13849-1 PL e.

A HIMax system consists of at least one baseboard (baseboard 0) and can expand up to 15 expansion baseboards, forming a powerful system with up to 16 baseboards. The system bus interconnects all baseboards through Ethernet cables to ensure efficient and reliable data transmission. HIMax provides excellent safety performance and availability, whether used for process controllers, protection systems, burners, or machine controllers.

System architecture and core components

2.1 Base plate and module

The HIMax system offers three types of baseboards: 10 slot, 15 slot, and 18 slot, to accommodate I/O requirements of different scales. Each slot can accommodate one module and its corresponding connection board. The system bus module must be installed in the two slots on the left side of each backplane (slots 1 and 2) to manage redundant system buses A and B. The processor module must follow specific rules to be installed in the designated slots of backplane 0 and backplane 1 (such as slots 3-6), and can support up to 4 processor modules for redundancy. All unused slots must be plugged into empty modules to ensure ventilation and heat dissipation inside the system.

2.2 System Bus

The core of the HIMax system is its dual redundant system bus (system bus A and B). These two buses run inside the motherboard and are managed through the system bus module. The system bus module manages bus A in slot 1 and bus B in slot 2. When both modules are used, the communication is conducted on both buses at the same time, and the failure of any module will not affect the connection of other modules.

The system bus is connected between the baseboards through Ethernet jumpers. When connecting, the "UP" port of one motherboard must be connected to the "DOWN" port of the next motherboard, and system buses A and B must not be cross connected.

System bus expansion: Based on Ethernet technology, the system bus can be extended over long distances using components such as fiber optics, with a maximum distance of 19.6 kilometers. This is crucial for the integration of distributed production lines or vast factory areas. During design, strict calculation of signal delay is required to ensure that the delay between redundant processor modules does not exceed 10 microseconds, and the delay between processor modules and the farthest I/O module does not exceed 50 microseconds.

Redundant design: the cornerstone of high availability

The conceptual design of the HIMax system is characterized by high availability, and almost all system components can operate redundantly. Redundancy does not increase the level of security integrity, but it can significantly improve system availability.

3.1 Redundancy of processor modules

The system can be configured in single processor mode or multiple redundancy mode (up to four).

Reduce redundancy: When any processor module in a redundant system fails or is removed, the remaining modules can seamlessly take over, ensuring continuous safe operation.

Increase redundancy: When a new processor module is inserted into the running system, it will automatically synchronize its configuration with the existing module. The premise is that the user program has been configured as redundant, has available slots, and both system buses are working properly.

3.2 I/O module and channel redundancy

Module redundancy: Two or three I/O modules of the same type can be defined as redundant with each other in programming tools. You can also set the 'backup module' attribute to avoid triggering error messages due to module failure or missing.

Channel redundancy: On the basis of module redundancy, channels with the same channel number can be defined as redundant. The programming tool will automatically assign a global variable to the corresponding channel of the redundant module. For input channels, users can specify how the controller combines the signals of two redundant channels into a final value.

Redundant connection board: To simplify wiring, special redundant connection boards can be used. This connection board occupies two adjacent slots and can allocate the signal of one sensor to two redundant input modules, or merge the signals of two redundant output modules and output them to one actuator. Only one on-site wiring is required.

3.3 Communication and Power Redundancy

Communication redundancy: SafeEthernet communication connections can be configured as redundant in SILworX, meaning there are two identical physical transmission paths. The redundancy of standard protocols such as Modbus and PROFIBUS needs to be managed by user programs.