Related Manuals for HIMA HIMatrix F35
Summary of Contents for HIMA HIMatrix F35
- Page 1 HIMatrix Safety-Related Controller Safety manual HIMA Paul Hildebrandt GmbH + Co KG Industrial Automation Rev. 1.01 HI 800 023 E...
- Page 2 HIMA directly. HIMA appreciates any suggestion on which information should be included in the manual. Equipment subject to change without notice. HIMA also reserves the right to modify the written material without prior notice. For further information, refer to the CD-ROM and our website http://www.hima.de and http://www.hima.com.
-
Page 3: Table Of Contents
HIMatrix Table of Contents Table of Contents Safety manual ............7 Structure and Use of the Document..............7 Target Audience..................... 8 Formatting Conventions ..................8 1.3.1 Safety Notes ......................8 1.3.2 Operating Tips ......................9 Intended Use ............10 Scope ........................10 2.1.1 De-Energize to Trip Principle/ Energize to Trip Principle........ - Page 4 Table of Contents HIMatrix 3.5.2 EU Type Examination..................... 22 Central Functions ..........23 Power Supply Units....................23 Functional Description of the Processor System ..........23 Self-Tests ......................24 4.3.1 Microprocessor Test ....................24 4.3.2 Memory Areas Test ....................24 4.3.3 Protected Memory Areas..................
- Page 5 HIMatrix Table of Contents 6.4.4 Behavior in the Event of External Short-Circuit or Overload ........36 Relay Outputs....................... 36 6.5.1 Test Routines for Relay Outputs................36 6.5.2 Reaction in the Event of a Fault................37 Safety-Related Analog Outputs (F60) ..............37 6.6.1 Test Routines......................
- Page 6 Table of Contents HIMatrix 8.2.12 Online Test ......................57 8.2.13 Program Documentation for Safety-Related Applications ........58 Configuring Communication ........59 Standard Protocols ....................59 Safety-Related Protocol (safeethernet) .............. 59 9.2.1 Receive Timeout ....................59 9.2.2 Response Time ...................... 60 9.2.3 Maximum Cycle Time of the HIMatrix Controller ............
-
Page 7: Safety Manual
Proper technical implementation of the safety instructions detailed in this manual performed by qualified personnel. HIMA will not be held liable for severe personal injuries, damage to property or the environment caused by any of the following: Unqualified personnel working on or with the devices. -
Page 8: Target Audience
1 Safety manual HIMatrix The manual distinguishes among the different variants using: Separated chapters Tables differentiating among the versions, e.g., versions beyond 7, or prior to version 7 Projects created with ELOP II Factory cannot be edited with SILworX, and vice versa! This manual usually refers to compact controllers and remote I/Os as devices, and to the plug-in cards of a modular controller as modules. -
Page 9: Operating Tips
HIMatrix 1 Safety manual The signal words have the following meanings: Danger indicates hazardous situation which, if not avoided, will result in death or serious injury. Warning indicates hazardous situation which, if not avoided, could result in death or serious injury. Warning indicates hazardous situation which, if not avoided, could result in minor or modest injury. -
Page 10: Intended Use
2 Intended Use HIMatrix Intended Use Scope The safety-related HIMatrix controllers can be used in applications up to SIL 3 in accordance with IEC 61508. The HIMatrix systems are certified for use in process controllers, protective systems, burner controllers, and machine controllers. When implementing safety-related communications between the various devices, ensure that the system's overall response time does not exceed the fault tolerance time. -
Page 11: Climatic Requirements
HIMatrix 2 Intended Use Standard Content EC/EN 61131-2: Programmable controllers, Part 2 2006 Equipment requirements and tests IEC/EN 61000-6-2: 2005 Generic standards, Parts 6-2 Immunity for industrial environments IEC/EN 61000-6-4: Electromagnetic Compatibility (EMC) 2006 Generic emission standard, industrial environments Table 2: Standards for EMC, Climatic and Environmental Requirements When using the safety-related HIMatrix control systems, the following general requirements must be met:... -
Page 12: Emc Requirements
2 Intended Use HIMatrix 2.3.3 EMC Requirements Higher interference levels are required for safety-related systems. HIMatrix systems meet these requirements in accordance with IEC 62061 and IEC 61326-3-1 (DIS). See column "Criterion FS“ (Functional Safety). IEC/EN 61131-2 Interference immunity tests Criterion IEC/EN 61000-4-2 ESD test: 6 kV contact, 8 kV air discharge... -
Page 13: Esd Protective Measures
HIMatrix 2 Intended Use 2.3.5 ESD Protective Measures Only personnel with knowledge of ESD protective measures may modify or extend the system or replace a module. NOTE Electrostatic discharge can damage the electronic components within the HIMatrix systems! When performing the work, make sure that the workspace is free of static, and wear an ESD wrist strap. -
Page 14: Additional System Documentation
2 Intended Use HIMatrix Additional System Documentation In addition to this manual, the following documents for configuring HIMatrix systems are also available: Name Content Document no. Part no. D = German E = English HIMatrix Description on how to plan and HI 800 100 (D) PDF file Engineering Manual... -
Page 15: Safety Concept For Using The Pes
HIMatrix 3 Safety Concept for Using the PES Safety Concept for Using the PES This chapter contains important general items on the functional safety of HIMatrix systems. Safety and availability Time parameters important for safety Proof test Safety requirements Certification Safety and availability The HIMatrix systems are certified for use in process controllers, protective systems, burner controllers, and machine controllers. -
Page 16: Self-Test And Fault Diagnosis
3 Safety Concept for Using the PES HIMatrix 3.1.2 Self-Test and Fault Diagnosis The operating system of the controllers executes comprehensive self-tests at start-up and during operation. The following components are tested: Processors Memory areas (RAM, non-volatile memory) Watchdog The individual I/O channels If faults are detected during the tests, the operating systems switches off the defective module or remote I/O, or the faulty I/O channel. -
Page 17: Time Parameters Important For Safety
Power supply of the controller. Components of the controller: HIMatrix compact controllers, modules, remote I/Os. When relay outputs are used, HIMA recommends to configure the relay outputs and the actuators' power supply redundantly. Reason: - A relay output has no line monitoring. -
Page 18: Multiple Fault Occurrence Time (Mot)
HIMA safety systems must be subjected to a proof test in intervals of 10 years. This interval can often be extended by calculating and analyzing the implemented safety loops. -
Page 19: Safety Requirements
The approved hardware and software are listed in the Version List of Devices and Firmware of HIMatrix Systems of HIMA Paul Hildebrandt GmbH + Co KG, Certificate-No. 968/EZ 128.19/09. The latest versions can be found in the version list maintained together with the test authority. -
Page 20: Communication
3 Safety Concept for Using the PES HIMatrix The correct implementation of the application specification must be validated and verified. A complete test of the logic must be performed by trial. Repeat this procedure every time the application is changed. The system response to faults in the fail-safe input modules, output modules and remote I/Os must be defined in the user program in accordance with the system-specific safety- related conditions. -
Page 21: Certification
HIMatrix 3 Safety Concept for Using the PES Certification HIMA safety-related automation devices (Programmable Electronic Systems, PES) of the HIMatrix system have been tested and certified by TÜV for functional safety in accordance with and the standards listed below: 3.5.1 TÜV Certificate... -
Page 22: Eu Type Examination
3 Safety Concept for Using the PES HIMatrix 3.5.2 EU Type Examination TÜV Anlagentechnik GmbH Automation, Software and Information Technology Am Grauen Stein 51105 Köln EU Type Examination Certificate n. 01/205/0644/09 Safety PES System Family HIMatrix F20, F30, F31, F35, F60, RIO-NC International standards: EN / IEC 61508, Parts 1-7: 2001 SIL 3... -
Page 23: Central Functions
HIMatrix 4 Central Functions Central Functions The controllers and remote I/Os of type F1.., F2.., F3.. are compact systems that cannot be modified. The controllers of type F60 are modular systems that, when combined with a power supply module and a processor module, may be used with up to 6 I/O modules. Power Supply Units A power supply module is only available with the F60. -
Page 24: Self-Tests
4 Central Functions HIMatrix Properties of the F60 CPU 01 processor module Two synchronous microprocessors (processor 1 and processor 2). Each microprocessor has its own RAM memory. Testable hardware comparators for all external accesses of both microprocessors. In the event of an error the watchdog is set to a safe state. Flash EPROM for operating system and user program, suitable for at least 100,000 memory cycles. -
Page 25: Reactions To Processor System Failures
HIMatrix 4 Central Functions 4.3.7 Reactions to Processor System Failures A hardware comparator within the central area permanently compares whether the commands and data in microprocessor system 1 and in microprocessor system 2 are identical. If they are different, or if the test routines detect failures in the processor module, the watchdog signal is automatically switched off. -
Page 26: Inputs
5 Inputs HIMatrix Inputs Overview of the HIMatrix system inputs: Device Type Number of Safety- Non-reactive Electrically inputs related isolated F20 controller Digital • • F30 controller Digital • • F31 controller Digital • • F35 controller Digital • • 24-bit •... -
Page 27: Safety Of Sensors, Encoders And Transmitters
HIMatrix 5 Inputs Safety of Sensors, Encoders and Transmitters In safety-related applications, the controller and its connected sensors, encoders and transmitters must all meet the safety requirements and achieve the specified SIL. For more on this, see the Annex Increasing the SIL of Sensors and Actuators. Safety-Related Digital Inputs The described properties apply to both digital input channels of F60 modules and digital input channels of all compact systems (unless stated otherwise). -
Page 28: Configurable Digital Inputs
5 Inputs HIMatrix Activating noise blanking increases the response time of the HIMatrix system! The measures specified above are not necessary if the plant design precludes surges from occurring within the system. In particular, the design must include protective measures with respect to overvoltage, lightning, earth grounding and plant wiring in accordance with the relevant standards and the instructions specified in the System Manual (HI 800 141 or HI 800 191). -
Page 29: Safety-Related Analog Inputs (F35, F3 Aio 8/4 01 And F60)
HIMatrix 5 Inputs Configurable 5...2 000 µs Figure 3: Pulsed Signal T1, T2 Line control detect the following faults: Cross-circuit between two parallel lines, Improper connections of two lines (e.g., TO 2 to DI 3), Earth fault of a line (with earthed ground only), Open-circuit or open contacts, i.e., including when one of the two EMERGENCY STOP switches mentioned above has been engaged, the LED blinks and the error code is created. -
Page 30: Table 16: Analog Inputs Of The F35 Controller
The analog inputs of the F35 controller, the F3 AIO 8/4 01 remote I/O and the AI 8 01 module operate with voltage measurement. With the analog inputs of the HIMatrix F35 and F3 AIO 8/4 01, digital outputs of the own system (F35) or of other HIMatrix controllers can be monitored to detect open-circuits. -
Page 31: Test Routines
HIMatrix 5 Inputs voltage is not reliable; with voltage inputs, the channels must be terminated with a 10 kΩ resistor. The internal resistance of the source must be taken into account. To measure currents, the shunt is connected in parallel to an input; in doing so the 10 kΩ resistor is not required. -
Page 32: Safety-Related Counters (F35 And F60)
Table 21: Error Codes with Counter Inputs Checklist for Safety-Related Inputs HIMA recommends using the following checklist for engineering, programming and starting up safety-related inputs. It can be used for helping with planning as well as to demonstrate later on that the planning phase was carefully completed. -
Page 33: Outputs
HIMatrix 6 Outputs Outputs Overview of the HIMatrix system outputs: Device Type Number of Safety- Electrically inputs related isolated F20 controller Digital • Pulse F30 controller (configurable for Digital • line control) F31 controller (configurable for Digital • line control) F35 controller •... -
Page 34: Safety Of Actuators
6 Outputs HIMatrix Safety of Actuators In safety-related applications, the controller and its connected actuators must all meet the safety requirements and achieve the specified SIL. For more details, see Increasing the SIL of Sensors and Actuators in the Annex. Safety-Related Digital Outputs The following points apply to the digital output channels of the F60 modules and to the digital output channels of the compact systems, but not to the relay outputs. -
Page 35: Test Routines For Two-Pole Digital Outputs
HIMatrix 6 Outputs 6.4.1 Test Routines for Two-Pole Digital Outputs The devices are tested automatically during operation. The main test functions are: Reading the output signals back from the switching amplifier. The switching threshold for a read-back signal is 2 V. The diodes used prevent a feed back of signals. Checking the integrated (redundant) safety shutdown. -
Page 36: Reaction In The Event Of A Fault
6 Outputs HIMatrix NOTE The controller or contiguous electronic devices or systems may be disturbed! Inductive loads must be connected with free-wheeling diode on the actuator. 6.4.3 Reaction in the Event of a Fault DO- Outputs If a faulty signal is detected, the device or module sets the affected output to the safe, de- energized state using the safety switches. -
Page 37: Reaction In The Event Of A Fault
HIMatrix 6 Outputs 6.5.2 Reaction in the Event of a Fault If a faulty signal is detected, the device or module sets the affected output to the safe, de- energized state using the safety switches. If a module fault occurs, all module outputs are switched off. -
Page 38: Analog Outputs With Safety-Related Shutdown (F3 Aio 8/4 01)
The error code allows the user to configure additional fault reactions in the user program. Checklist for Safety-Related Outputs HIMA recommends using this checklist for engineering, programming and starting up safety-related outputs. It can be used for helping with planning as well as to demonstrate later on that the planning phase was carefully completed. -
Page 39: Software For Himatrix Systems
HIMatrix 7 Software for HIMatrix Systems Software for HIMatrix Systems The software for the safety-related automation devices of the HIMatrix systems consist of the following components: Operating system User program Programming tool in accordance with IEC 61131-3. The operating system is loaded into the controller's central part (CPU) and must be used in the current version certified by TÜV for safety-related applications. -
Page 40: Verifying The Configuration And The User Program
7.3.3 Archiving a Project HIMA recommends archiving the project every time the program is loaded into the controller by performing a download or a reload. The procedure for archiving a project is radically different in ELOP II Factory and SILworX. -
Page 41: Options For Identifying The Program And The Configuration
HIMatrix 7 Software for HIMatrix Systems To create a project archive 1. Print the user project to compare the logic with the specifications. 2. Compile the user program for generating the CPU configuration CRC. 3. Verify the CRCs and note down the CPU configuration CRC version. To do so, right- click the controller in the Hardware Management and select Configuration Information to display the versions. -
Page 42: Resource Parameters
7 Software for HIMatrix Systems HIMatrix Resource Parameters DANGER Physical injury possible due to incorrect configuration! Neither the programming system nor the controller can verify certain project-specific parameters. For this reason, enter these parameters correctly and verify the whole entry. These parameters are: System ID Rack ID, refer to the system manuals (HI 800 141 and HI 800 191). -
Page 43: Table 23: System Parameters Of The Resource
HIMatrix 7 Software for HIMatrix Systems Parameter / Switch Function Default Setting for setting safe operation Name Resource name Arbitrary System ID [SRS] System ID of the resource Unique value within 1...65 535 the controller network. This includes all con- 60 000 trollers that may be potentially connected... -
Page 44: Parameters - Versions Prior To 7
7 Software for HIMatrix Systems HIMatrix Global variables can be assigned to these system variables; the value of the global variables is modified using a physical input or the user program logic. Example: A key switch is connected to a digital input. The digital input is assigned to a global variable associated with the system variable Read only in Run. -
Page 45: Checklist For Creating A User Program
7 Software for HIMatrix Systems Checklist for Creating a User Program To comply with all safety-related aspects during the programming phase, HIMA recommends using the checklist prior to and after loading a new or modified program. The checklist HIMatrix_Checklist_Program.doc is available in Microsoft® Word® format. All the checklists are contained in the ZIP file HIMatrix_Checklists.zip that can be downloaded... -
Page 46: Safety-Related Aspects Of The User Program
8 Safety-related Aspects of the User Program HIMatrix Safety-related Aspects of the User Program General sequence for programming HIMatrix automation devices for safety-related applications: Specify the controller functionality. Write the user program. Use the C-code generator to compile the user program. Compile the user program a second time and compare the resulting CRCs. -
Page 47: Functions Of The User Program
HIMatrix 8 Safety-related Aspects of the User Program The I/O concept of the system must include an analysis of the field circuits, i.e. the type of sensors and actuators: Sensors (digital or analog). - Signals during normal operation ('de-energize-to-trip' principle with digital sensors, 'life-zero' with analog sensors). -
Page 48: Acceptance By Test Authority
8.1.4 Acceptance by Test Authority HIMA recommends involving the test authority as soon as possible when designing a system that is subject to approval. Procedures This chapter describes the procedures typically used for developing the user programs for safety-related HIMatrix controllers. -
Page 49: System Parameters Of The Resource
HIMatrix 8 Safety-related Aspects of the User Program 8.2.2 System Parameters of the Resource The parameters listed below define how the controller behaves during operation and are configured in the resource's properties. Specific switches define which PADT actions are allowed during safety-related operation. System Parameters of the Resource - Versions Beyond 7 These parameters define how the controller behaves during operation and are configured for the resource in the Properties dialog box in SILworX. -
Page 50: Table 27: System Parameters Of The Resource - Versions Beyond 7
8 Safety-related Aspects of the User Program HIMatrix Parameter / Description Default Setting for safe Switch value operation Sum of UP Max. Sum of the values indicated for Max. Duration for each Duration for Each Cycle [µs] in all the user programs. Cycle [µs] Not changeable Not applicable for HIMatrix controllers! -
Page 51: Table 28: System Parameters Of The Cpu
HIMatrix 8 Safety-related Aspects of the User Program System Parameters of the Resource - Versions Prior to 7 Switch Function Default Setting for value safe operation Main enable The following switches/parameters can be changed during operation (= RUN) using the PADT. Autostart Automatic start after powering on the ON / OFF... -
Page 52: Locking And Unlocking The Controller
8 Safety-related Aspects of the User Program HIMatrix Global variables can be assigned to these system variables; the value of the global variables is modified using a physical input or the user program logic. Example: A key switch is connected to a digital input. The digital input is assigned to a global variable associated with the system variable Read only in Run. -
Page 53: Code Generation
HIMatrix 8 Safety-related Aspects of the User Program To lock a controller 1. Set the following values in the controller prior to compiling (see also Chapter Code Generation): Main Enable set to ON Forcing allowed set to OFF (depending on the application) Test mode allowed set to OFF Start/Restart allowed... -
Page 54: Loading And Starting The User Program
Afterwards, the user program can be started, i.e. the routine begins to be processed in cycles. HIMA recommends backing up project data, e.g., on a data storage medium, after loading a user program into the controller. -
Page 55: Forcing - Versions Beyond 7
HIMatrix 8 Safety-related Aspects of the User Program Basic information on forcing can be found in the TÜV document "Maintenance Override“. This document is available on the TÜV homepage: http://www.tuv-fs.com or http://www.tuvasi.com. 8.2.7 Forcing - Versions Beyond 7 Forcing can operate at two levels:: Global forcing: Global variables are forced for all applications. -
Page 56: Force Editor
8 Safety-related Aspects of the User Program HIMatrix WARNING Use of forced values can disrupt the safety integrity! Only remove existing forcing restrictions with the consent of the test authority responsible for the final system acceptance test. 8.2.10 Force Editor SILworX Force Editor lists all variables, grouped in global and local variables. -
Page 57: Online Test
HIMatrix 8 Safety-related Aspects of the User Program - The entered force values are kept, but are not effective. Set: - Forcing is allowed - The entered force values only become effective if the corresponding force switch has also been set for the data source. Forcing is terminated and the process value reactivated upon expiration of the force time or when forcing is intentionally stopped. -
Page 58: Program Documentation For Safety-Related Applications
8 Safety-related Aspects of the User Program HIMatrix Versions Beyond 7 Online test fields (OLT fields) can be used in the user program logic to display variables while the controller is operating. For more information on how to use OLT fields, enter OLT field in the SILworX online help. Versions Prior to 7 The CPU switch Changing the variables in the OLT allowed defines the possibility to change variablen online. -
Page 59: Configuring Communication
HIMatrix 9 Configuring Communication Configuring Communication In addition to using the physical input and output variables, variables can also be exchanged with other system through a data connection. In this case, the variables of the corresponding resource are declared in the Protocols Editor of the programming tool. This data exchange can occur in either read-only or read/write mode. -
Page 60: Response Time
9 Configuring Communication HIMatrix If a correct response is not received from the communication partner within ReceiveTMO, safety-related communication is terminated. The input variables of this safeethernet connection react in accordance with the preset parameter Freeze Data on Lost Connection [ms]. -
Page 61: Maximum Cycle Time Of The Himatrix Controller
9.2.3 Maximum Cycle Time of the HIMatrix Controller To determine the maximum cycle time for a HIMatrix controller, HIMA recommends proceeding as follows: To determine the maximum cycle time for the HIMatrix controller 1. Use the system under the maximum load. In the process, all communication connections must be operating both via safeethernet and standard protocols. -
Page 62: Calculating The Worst Case Reaction Time With Two Remote I/Os
9 Configuring Communication HIMatrix Worst case reaction time 2 * watchdog time of the HIMatrix controller 1. ReceiveTMO 2 * watchdog time of the HIMatrix controller 2. The worst case reaction time depends on the process and must be agreed upon together with the test authority responsible for the final inspection. -
Page 63: Terms
HIMatrix 9 Configuring Communication Worst case reaction time 2 * watchdog time of the HIMatrix controller 1. ReceiveTMO 2 * watchdog time of the HIMax controller. ReceiveTMO 2 * watchdog time of the HIMatrix controller 2. Remark: HIMatrix controller 1 and HIMatrix controller 3 can also be identical. 9.2.7 Terms ReceiveTMO... -
Page 64: Use In Fire Alarm Systems
10 Use in Fire Alarm Systems HIMatrix Use in Fire Alarm Systems The HIMatrix systems may be used in fire alarm systems in accordance with DIN EN 54-2 and NFPA 72, if line monitoring is configured for the inputs and outputs. In this case, the user program must fulfill the requirements specified for fire alarm systems in accordance with the standards previously mentioned. -
Page 65: Figure 8: Example Of Open-Circuit And Short-Circuit Monitoring Of Digital Outputs
(Actuator Circuit) For an example of how to configure the open-circuit and short-circuit monitoring of actors using analog inputs, refer to Chapter Line Monitoring in the HIMatrix F35 Manual (HI 800 149). A suitable user program can be used to control visual display systems, indicator light panels, LED indicators, alphanumeric displays, audible alarms, etc. - Page 66 10 Use in Fire Alarm Systems HIMatrix Page 66 of 72 HI 800 023 E Rev. 1.01...
-
Page 67: Appendix
HIMatrix Appendix Appendix Increasing the SIL of Sensors and Actuators Safety-related HIMatrix controllers are used in safety applications up to SIL 3. This requires that the sensors and actuators (signalers and actuating elements) in use also achieve the required SIL. In some cases, sensors or actuators may not be available for the requirements defined in the application, such as process value, range of value, SIL, etc. -
Page 68: Glossary
Appendix HIMatrix Glossary Term Description Address Resolution Protocol: Network protocol for assigning the network addresses to hardware addresses Analog Input COMmunication module Cyclic Redundancy Check Digital Input Digital Output ELOP II Factory Programming tool for HIMatrix systems ElectroMagnetic Compatibility European Norm ElectroStatic Discharge FieldBus Function Block Diagrams... -
Page 69: Index Of Figures
HIMatrix Appendix Index of Figures Figure 1: Function Blocks of the F60 CPU 01 Figure 2: Line Control Figure 3: Pulsed Signal T1, T2 Figure 4: Reaction Time with Interconnection of Two HIMatrix Controllers Figure 5: Reaction Time with Remote I/Os Figure 6: Reaction Time with Two HIMatrix Controllers and One HIMax Controller Figure 7:... -
Page 70: Index Of Tables
Appendix HIMatrix Index of Tables Table 1: HIMatrix System Variants Table 2: Standards for EMC, Climatic and Environmental Requirements Table 3: General requirements Table 4: Climatic Requirements Table 5: Mechanical Tests Table 6: Interference Immunity Tests Table 7: Interference Immunity Tests Table 8: Noise Emission Tests Table 9:... -
Page 71: Index
HIMatrix Appendix Index de-energize to trip principle ..... 10 Hardware Editor ........51 energize to trip principle ......10 online test field ........58 fault reactions operating requirements analog inputs........31 climatic..........11 analog outputs ....... 37, 38 EMC............. 12 counter inputs ........ -
Page 72: P.o. Box
HIMA Paul Hildebrandt GmbH + Co KG P.O. Box 1261 68777 Brühl, Germany Tel: +49 6202 709-0 Fax: +49 6202 709-107 E-mail: info@hima.com Internet: www.hima.com (1018)
Need help?
Do you have a question about the HIMatrix F35 and is the answer not in the manual?
Questions and answers