h41q-h51q Operating System

Programmable Systems
Functions of the Operating System
BS41q/51q V7.0-7 (9906)
HIMA Paul Hildebrandt GmbH + Co KG

Industrie-Automatisierung
Attention:
Maintenance on supply, signal and data lines may only be executed by qualified personnel with
consideration off all ESD protection measures. With direct contact of this lines the maintenance personnel have to be electrostatic discharged!
Important Note
All HIMA products mentioned in this manual are protected with the HIMA trade-mark. As not differently noted down this is possibly also valid for other mentioned manufactueres and their products.
The technology is subject to changes without notice.
All technical statements and data in this manual have been worked out very carefully, and effective
checks and inspections have been applied. This manual may however contain flaws or typesetting
errors. Therefore HIMA does not offer any warranties nor assume legal reponsibility nor any liability
for the possible consequences of any errors in this manual. HIMA would appreciate being informed
on possible errors.
Conditions of Supply and Delivery

The General Conditions of Supply and Delivery for the Products and Services of the German Electrical Industry apply for our deliveries and services.
Eventual complaints can be recognized only when we are being notified within 14 days after receipt
of the merchandize.
The prices shown in a special list are valid ex works, packing charges excluded. The prices ars subject to change.
Table of Contents
Table of Contents
The Functions of the Operating System . . . . . . . . . . . . . . . 3
2
2.1
Identification of the Operating Systems . . . . . . . . . . . . . . . 5

The BS41q/51q Operating System, V7.0-7 . . . . . . . . . . . . . . . 5
3
3.1
3.2
Assignment tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Assignment of the Operating Systems to the
Types of Central Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Assignment of the Operating Systems to other Firmware . . . . 6
Cycle Run . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
5
5.1
5.2
HIMA - Standard functions . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Standard Building Blocks Independent of the IO level . . . . . . . 9
Applicable IO Modules with Associated
Software Building Blocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Overview of the possible couplings . . . . . . . . . . . . . . . . . . 11
7
7.1
7.2
7.3
Coupling with Other HIMA PES . . . . . . . . . . . . . . . . . . . . .

Non-Safety Related Data Transmission . . . . . . . . . . . . . . . . .
Safety Related Data Transmission . . . . . . . . . . . . . . . . . . . . .
Safety Related Communication via
Communication Module F 8625 . . . . . . . . . . . . . . . . . . . . . . .
11
12
12
12
8
8.1
8.2
Coupling with HIMA Master Systems . . . . . . . . . . . . . . . . . 13

Engineering Station (ELOP II) . . . . . . . . . . . . . . . . . . . . . . . . 13
Visualisation system (PLESY II) . . . . . . . . . . . . . . . . . . . . . . . 13
Logic Plan Controlled Logging . . . . . . . . . . . . . . . . . . . . . . 14
10
10.1
Coupling with External Systems . . . . . . . . . . . . . . . . . . . .

Coupling with Process Control Systems via
MODBUS Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Available Reading Codes 1, 3 . . . . . . . . . . . . . . . . . . . . . . . .
Available Writing Codes 5, 15, 6, 16 . . . . . . . . . . . . . . . . . . .
Loop Back Diagnostic Test, Code 8 . . . . . . . . . . . . . . . . . . . .
Function Codes for Events 65, 66, 67 . . . . . . . . . . . . . . . . . .
Events Checks via Standard Codes 1,3 . . . . . . . . . . . . . . . . .
Time Synchronization, CODE 70 . . . . . . . . . . . . . . . . . . . . . .
Time Synchronization, CODE 6 . . . . . . . . . . . . . . . . . . . . . . .
Hints on the Operation of the System . . . . . . . . . . . . . . . . . .
Coupling with the 3964R Protocol (SIEMENS Devices) . . . .
Overview of the Functions of the 3964R Protocol . . . . . . . . .
Available Writing Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Available Reading Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Error Codes Transmitted to the Master . . . . . . . . . . . . . . . . .
10.1.1
10.1.2
10.1.3
10.1.4
10.1.5
10.1.6
10.1.7
10.1.8
10.2
10.2.1
10.2.2
10.2.3
10.2.4
14
14
16
17
18
18
20
23
23
23
24
24
25
25
25
Table of Contents
11
11.1
11.2
11.3
11.4
Diagnostic Display . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Information to be Called during RUN Operation . . . . . . . . . .
Errors in the Central Area (CPU LED lights up) . . . . . . . . .
Errors in the IO Area (IO LED lights up) . . . . . . . . . . . . . . .
List of Error Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
26
26
29
29
30
The Functions of the Operating System

The program of the operating system contains all the basic functions of the
HIMA Programmable Electronic System (PES). The functions to be performed by the respective PES are defined via the ELOP II system software
in the user program. A code generator translates the user program into the
machine code. This machine code is transmitted to the Flash-EPROM of
the central module via a serial interface.
The main functions of the operating system and the selections in the user
program are listed in the table below.
Functions of the operating system
Work in the user program
Cyclic work of the user program
Function blocks, functions, variables
HIMA standard building block

(stored in the operating system)
Standard building block, variables
Configuration of the PES

1 or 2 IO-bus, number of power packs.
Configuration in resource type
Reload of the user program
possible with restrictions

(ref. manual (CD) ELOP II Resource-Type H41q/
H51q)
Tests in central area and in IO-bus
Tests of IO-modules (dependant on type)
Type of IO-module
Reaction with error
fixed or configureable
Diagnostic display
Diagnostic mode for testable IO-modules
Software building block HZ-DOS-3
Communication with serial interface

Engineering station
permissible things during running
ELOP II
PLESY II
PLESY II Logline
Configuration in resource type

Variable Declaration,
external coupling
attributes, event - controlled
PES-Master, non safety related
Variable Declaration, attributes, HIBUS communication
PES-Master, safety related
Variable Declaration, attributes, safety related

HIBUS communication
MODBUS-Mastersystems
Variable Declaration, external coupling
MODBUS-Slavesystems
Software buildingblock HK-MMT-3,

Mastersystems with protocol 3964 R
logic controlled logging
Variable Declaration, attributes, event - controlled, history

If a master system requests data (read data) via the serial interfaces (engineering station, process control system via MODBUS coupling, etc.) the
PES answers immediately (instant answer) on the interface from which it
received the read request.
The write data received via the serial interfaces are stored in a buffer and
taken over at the beginning of the next cycle. Depending on the master the
answer comes either instantly (PLESY II, PES master) or when the datas
are taken over.
Maximum size of user program:
512 kByte program

96 kByte data
Buffer size of the serial interfaces:
512 bytes
Identification of the Operating Systems
Identification of the Operating Systems
2.1
The BS41q/51q Operating System, V7.0-7

The program of the operating system is loaded in one Flash-EPROM with
1 MB. The operating system has the identification:
BS41q/51q V7.0-7 (9906)

Furthermore the signature of the operating system is used as Identification. The signature can be called on the diagnostic display during operation
of the automa-tion device. The signature is:
BS-CRC: 2E49
Assignment tables
Assignment tables
3.1
Assignment of the Operating Systems to the

Types of Central Modules
System family
H41q
H51q
H41q-S
H51q-S
System name
H41q-M
H41q-H
H41q-HR
H41q-MS
H41q-HS
H41q-HRS
H51q-M
H51q-H
H51q-HR
H51q-MS
H51q-HS
H51q-HRS
Central unit
F 8653
F 8653
F 8652
F 8651
F 8651
F 8650
Operating system
TV tested
3.2
Operating system
BS41q/51q V7.0-7
Assignment of the Operating Systems to other Firmware
Operating system CM Ethernet module (EN-BG)

Code generator
BS51-CB V6.0-6
F 8625/F 8626
ELOP II RT H41/H51
edition
BS41q/51q V7.0-7
(9808)
V 1.0
V 2.0
BS41q/51q V7.0-7
(9808)
V 1.4
V 2.1
The edtions in bold types are the recommended editions.
Cycle Run
Cycle Run
The operating system continually processes the user program cyclically.
A greatly simplified form of the order of processing looks as follows:
Reading the input signals
Processing the logic functions

according to IEC 61131-3 chapter 4.1.3
Writing the output signals

plus the following essential functions:
Extensive self-tests
Tests of the IO modules during operation
Data transfer and data comparison

A cycle is processed in 7 stages.
Cycle run
PES with
2 central modules, 1 IO-bus
PES with
2 central modules, 2 IO-busses
1 central modules, 1 IO-bus
H41q-H, H41q-HS
H51q-H, H51q-HS
H41q-M, H41q-MS, H41q-HR, H41q-HRS

H51q-M, H51q-MS, H51q-HR, H51q-HRS
Stage 1
cyclically selftests
cyclically consistency test
master change central module
cyclically selftests
cyclically consistency test
Stage 2
Processing of all write transmissions

reading and testing of inputs (also from ENBG) from master central module
take over of receive data in variables
Processing of all write transmissions

reading and testing of inputs reading and
testing of inputs (also from EN-BG)
take over of receive data in variables
Stage 3
transmission of the inputs to the slave

central module
transmission of the inputs to the other central

module, if redundant central module exist
Stage 4
copy all internal variables to import variables

working of the user logic
write export data to EN-BG
cyclically comparison of memory
copy all internal variables to import variables

working of the user logic
write export data to EN-BG
cyclically comparision of the memory, if redundant central module exist
Stage 5
exchange of the output and comparison
exchange of the output and comparison, if

redundant central module exist
Stage 6
writing of the output signals by the master

central module
writing of the output signals
Stage 7
reading back of the output signals by the

slave central module and comparision
with correctly output signals next cycle
(stage 1)
switching off of the faulty output module with
unequal outputs (group shut down) and jump
to stage 5
reading back of the output signals by the slave

central module and comparision
with correctly ouput signals next cycle
(stage 1)
switching off of the faulty output module with
unequal outputs (group shut down) and jump
to stage 5
EN-BG = Ethernet Module
Cycle Run
Redundant central modules are synchronized after each cycle stage.
Communication via the serial interfaces and the parts of the self-test not
performed in every cycle are independent of the cycle stage.
For further test routines and reactions on errors cf safety manual.
HIMA - Standard functions

The following list shows the HIMA - standard building blocks. The description of the function of these building blocks is contained in the current CD
ELOP II-NT, in the manual ELOP II RT.
5.1
Standard Building Blocks Independent of the IO level

Type
Function
TV
tested
H8-UHR-3
Date and time
HA-PID-3
PID controller
HK-AGM-3
H51q PES-master-monitoring
HK-LGP-3
LCL evaluation and configuration
HK-MMT-3
Modbus-master
HZ-DOS-3
Diagnostic without safety
HZ-FAN-3
Error display testable IOs
TV test means that the respective building block can be used in safety
related PES, and that it has a TV safety certificate.
5.2
Applicable IO Modules with Associated

Software Building Blocks
IO-module
Type
TV
F 3221
F 3222
F 3223
F 3224
F 3225
F 3227
F 3228
Type
Function
TV
BS
F 3235
F 3236
F 3237
F 3238
F 3311
Software building block
HB-RTE-3
Monitoring of digital testable inp.
HB-RTE-3
Monitoring of digital testable inp..
HB-RTE-3
Monitoring of digital testable inp.

IO-module
Type
TV
Software building block

Type
Function
TV
BS
F 3312
F 3313
H8-STA-3
Group shut down
F 3314
H8-STA-3
Group shut down
F 3321
F 3322
HB-BLD-3/4
Module and line diagnosis
HB-BLD-3/4
HB-BLD-3/4
Temperature linearisation
F 3323
33311
F 3330
F
F 3332
F 3333
F 3334
F 3412
F 3413
F 3422
F 5202
F 5203
F 6103
HA-LIN-3
F 6204
HA-PMU-3
Input converter parametrization
F 6207
HA-LIN-3
HA-PMU-3
F 6208
HA-PMU-3
F 6213
HA-RTE-3
Monitoring analog testable inp.
F 6214
HA-RTE-3
Monitoring analog testable inp.
F 6215
HA-LIN-3
HA-PMU-3
F 6216
HA-LIN-3
HA-PMU-3
F 6217
HA-LIN-3
HA-PMU-3
HA-PMU-3
HZ-FAN-3
HA-PMU-3
Error display testable IOs

HA-PMU-3
F 6701
F 6705
F 6706
1) diagnostic mode wih HZ-DOS-3 possible

TV (TV test) means that the respective IO module or software building block may be used for safety related functions, and that they have a
TV safety certificate.
10
Overview of the possible couplings
Overview of the possible couplings

Coupling or protocol
Programming unit
Printer (logic plan controlled logging)
SIO-channel
1...8
2
PLESY II
PLESY II Logline
1...8
Siemens protocol 3964R (Master)
1,2
MODBUS-Master
1...8
MODBUS-Slave (modem) with building block HK-MMT-3
1,2
Safety related PES
1...8
PES (HIBUS with PES-Master)
1...8
Ethernet via communication module F 8625
acc. to IP address
Profibus DP-Slave via communication module F 8626
Stat. addr. 0...127
The communication is only working, if the HIMA PES is in RUN-mode. The

only exception is the communication with the Engineering Station (ELOP
II).
Coupling with Other HIMA PES

The operating systems are designed for data transmission between HIMA
PES via the HIBUS bus system. For this purpose, at least one H51q PES
with one coprocessor module is required which is used as PES master.
Here the interfaces on the central unit as well as those on the coprocessor
module can be used.
The safety-related transmission of data is also possible via Ethernet using
the communication module F 8625. A physical existing PES master is not
required, but only the definition of the configuration and monitoring of the
data transfer in ELOP II.
The data to be sent and received by a PES are defined as variables with
the attribut HIPRO-S (for safety-related data transfer).
The monitoring of the safety-related communication for regular reception
of data by the master system is configured in the properties of the resource-type . The imported datas are set to FALSE or 0, if the master system
does not write any data within the defined time.
11
Coupling with Other HIMA PES
7.1
Non-Safety Related Data Transmission

declaration will be done in the H51q variables assignments on the page
PES-Master HIPRO-N communication.
During operation the PES master reads all the data to be transmitted in the
PES connected, joins the transmissions for the PES and then sends the
data to the PES.
7.2
Safety Related Data Transmission

Start the configuration out of the resource type. The declaration will be
done in the H51q variables assignments on the page PES-Master HIPROS communication.
During operation the PES master organizes direct data transmission between the individual PES. The PES master itself does not store the data.
Although data transmission runs via the HIBUS, it has to be imagined as
a point-to-point connection.
7.3
Safety Related Communication via

Communication Module F 8625
Using the communication module F 8625 up to 64 HIMA PES of the H51q
system family can have a safety-related communication. This is realized
via the Ethernet communication according to IEEE 802.3. The data to be
transferred are depict from the CU through the communication module.
The bus type is HIBUS. The PES master is defined only as a dummy in
ELOP II. Via the properties in the variable declaration the variables are define as HIPRO-S variables. It is also possible to start a compiler run for the
(dummy-) PES master to get a cross reference list for the communiction
variables. For further communication hints please refer to the F 8625 data
sheet in the catalogue programmable systems of the H41q and H51q system families.
12
Coupling with HIMA Master Systems
Coupling with HIMA Master Systems

As HIMA Master Systems we understand Personal Computers with an
Windows NT operating system here. They are operated and configured
with HIMA system software programs. Via the serial interface they are either directly connected to the PES or they communicate with the HIMA
PES via the MODBUS. The communication is only working, if the HIMA
PES is in RUN-mode. The only exception is the communication with the
Engineering Station (ELOP II).
8.1
Engineering Station (ELOP II)

The engineering station is used for programming, loading, monitoring and
documenting the function of the HIMA PES with the programming and planing system ELOP II.
8.2
Visualisation system (PLESY II)

The visualisation system PLESY II is used for the configuration of any process displays and for the interpretation and writing of variables of the
HIMA PES.
It is only possible to write variables of the PES with the attribute Modbus
read/write.
Furthermore the visualisation system stores and prints out events. The
wished variables get the attibute event controlled in the H51q variables assignment. The events are stored in a buffer in the PES, and they are requested there by the visualisation system, where they are displayed on the
monitor or printed out on a connected printer. For later evaluation, it is possible to store the events on the hard disk. The configuration and the destination of the alarm text are done in PLESY II.
The visualisation system is able to display variables as trend curves on the

screen and store them on the hard disk. In the case the variables are
stored on the hard disk, it is possible to display historical trend curves.
13
Logic Plan Controlled Logging
Logic Plan Controlled Logging

Logic plan controlled logging is for recording events (signal changes with
time) of the central module and for printing them out with interpretation on
a printer connected to the HIBUS. Only interface 2 on the central module
can be used for logic plan controlled logging. The wished variables get the
attibute History Lcl in the variable declaration event.
The events and texts are part of the user program. Further additional
functions can be realized by the HK-LGP-3 software building block (cf description of the building block).
10 Coupling with External Systems

The operating system is designed for the serial communication with external systems (MODBUS, Fieldbus, OPC, 3964R, etc.).
The data to be transmitted are configured in the variable declaration as
BUSCOM variables.
The external system can read all variables of the PES, which have the attirbute Read (Variable Declaration). The data received from an external
system has the attirbute Write.
Directly used are the MODBUS protocol, as slave and master system, and
the Siemens 3964R protocol, as slave system. In the case the HIMA PES
is used as a slave system, no further HIMA standard buildingblocks in the
user program are needed for the communication. If the HIMA PES is used
as MODBUS master, the HIMA standard building block HK-MMT-3 is necessary in the user program. The function of the building block is explained in the description of the building block. The interface parameters are
defined in thebookshelf (settings) of the resource, if they differ from the default setting. (9600 baud or 57600 baud, 1 stop bit, even parity).
The communication module F 8626 with its integrated Fieldbus communication module enables the connection of a Profibus-DP slave.
With the communication module F 8625 and a HIMA OPC server can be
realized an Ethernet communication with the OPC protocol.
The communication with the external systems is only working, if the HIMA
PES is in RUN-mode.
10.1
Coupling with Process Control Systems via

MODBUS Protocol
The MODBUS protocol is designed for transmission to a bus (e.g. HIBUS)
as master-slave-system. It is usually applied for connecting HIMA PES to
a process control system. The H41q and H51q PES can be used as slave
systems, without further building blocks, and as master system, with the
building block HK-MMT3.
14
Coupling with External Systems

The MODBUS protocol was defined by the Gould Inc. We recommend
sending your request of the documents directly to AEG-Modicon and to
get some information on possible special features of the master system.
For better understanding the essential features are explained here.
Master-system
Slave-system
Slave Address
Function Code
Data
Error check
Slave Address
Function Code
Data
Error check
The Principle of Data Traffic with MODBUS Protocol

The HIMA PES only have the RTU (Remote Terminal Unit) mode of transmission, which is the customary way between computer systems. The
transmission is asynchronous with 8 bits and CRC error check.
This mode of data transmission usually has the following frame:
Start
Slave
Code
Data
Error
check
End of
telegr.
T1 T2
T3
1 byte
1 byte
2 bytes
T1 T2
T3
* The number of bytes depends on the function, the number of addresses

and data
Start
end of
telegr.
Start of transmission resp. end of

transmission is identified by a pause of
3 1/2 chars (bytes) (T1 T2 T3)
slave
address of the slave system (HIMA:

bus subscriber number, setting on
central module)
code
function code
writing or reading of variables, events
data
They comprise start address

number of adresses and data depends on
function, cf definitions in the MODBUS protocol.
error check
CRC (Cyclic Redundancy Check) which

is automatically generated by the transmitting system
4 functions can be realized with the MODBUS protocol:
Reading of variables
Writing of variables
Reading of events
Time synchronization
The master system can read and write the variables of the HIMA PES,
which habe the attribute Modbus read and write.
15

Any bool signal changes of variables can be defined as an event in the
ELOP II (Variable Declaration). The status of the bool signal in the current
cycle is compared to the status in the previous cycle. If there is a change,
the number of the event, the current status and the time of the PES at the
beginning of the cycle are stored in a buffer. Therefore events recorded in
the same cycle have the same time stamp.
Events can be read (reading from the buffer) with special function codes
not defined in the original MODBUS protocol or with standard codes (see
trend recording).
10.1.1 Available Reading Codes 1, 3

The function code 1 READ COIL STATUS is realized for bool variables
and the function code 3 for READ HOLDING REGISTER for unsigned integer variables. The Modbus address of the variables is part of the resource documentation RES-Docu (generated).
ERROR CODES (IN DATA READING)

CODE
EXPLANATION
address too high, variable does notexist.

data >256 bytes (2048 bool values, 128 integer values)
Example:
Reading of bool variablen
Slave number:
Function code:
Bool variables:
17
1
20...56 = 37 variables
The start address is listed in the RES-Docu (generated).

Start address:
20
Query message of the master system:
16
Type
Slave
Code
Starting address
Number
Check
DEC
17
20
37
CRC
HEX
11
01
00 25
2 bytes
00
14

Response message of the slave:
Type
Slave
Code
Bytes
Data
27-20
Data
35-28
Data
43-36
Data
51-44
Data
56-52
Check
DEC
17
205
107
178
14
27
CRC
HEX
11
01
05
CD*
6B*
B2*
0E*
1B*
2 bytes
* = possible values
CD (Hex) = 11001101 (binary), i.e. the variables no. 27, 26, 23, 22, and 20
have 1 signal and the variables no. 25, 24 and 21 have 0 signal.
Immediately after the request the PES sends the data to the master system.
For an example for reading out the buffer cf paragraph 10.1.5.
10.1.2 Available Writing Codes 5, 15, 6, 16

The function code 5 FORCE SINGLE COIL and 15 FORCE MULTIPLE
COILS are realized for bool variables and the function code 6 PRESET
SINGLE REGISTER and 16 PRESET MULTIPLE REGISTERS for unsigned integer variables. The Modbus address of the variables is part of the
resource documentation RES-Docu (generated).
ERROR CODES (IN DATA WRITING)
CODE
EXPLANATION
address too high, variable does not exist

data >256 bytes (2048 bool values, 128 integer values
EFFECT different from FF00 H resp. 0000 H (bool values)
Example:
Slave number:
Function code:
Bool variable:
17
5 (Force single coil)
37
The start address is listed in the RES-Docu (generated).

Address:
37
17

Transmission of the master:
Type
Slave
Code
Starting address
Data
DEC
17
37
65280
HEX
11
05
00
25
Check
FF 00
2 bytes
Check
Response message of the slave:

Type
Slave
Code
Starting address
Data
DEZ
17
37
65280
HEX
11
05
00
25
FF 00
2 bytes
The PES receives the data transmitted and writes them to the variables at
the beginning of the next cycle. Therefore the longest response time is the
cycle time of the PES.
10.1.3 Loop Back Diagnostic Test, Code 8

The diagnosis code 0 of the function code 8 is used to ask the slave system to repeat the request transmission of the master.
CODE
EXPLANATION
RETURN QUERY DATA
Valid for all HIMA-Slaves

The HIMA-master knows all 21 diagnosis codes
10.1.4 Function Codes for Events 65, 66, 67

Any bool signal changes of variables can be defined as events in the
ELOP II program (Variable Declaration). The status of the bool signal in
the current cycle is compared to the status of the previous cycle. If there
is a change, the number of the event, the current status and the time of the
PES at the beginning of a cycle are stored in a buffer. Events recorded in
the same cycle therefore have the same time stamp.
For the transmission of events from the slave system to a master system
codes 65, 66, 67 which are reserved for user functions in the original
MODBUS protocol were used.
18
CODE
EXPLANATION
FUNCTION
65
read event values

(status of the events)
returns the status of all event

names without the time
66
read new events

(address, status, time)
returns the events from the event

buf-fer including the time
67
last events
request to repeat the last telegram

Transmission Formats (Reading Events)
SLAVE
CODE
BC
HO
LO
65
BYTE COUNT
START. POINT
66
BYTE COUNT
not used
67
BYTE COUNT
not used
HO
LO
ERROR
CHECK
QTY. OF PTS
Function code 65: Reading event values (status of events)

STARTING-POINT
is always 0.
QUANTITY OF POINTS
is always the total number of events (highest number + 1). The values are
transmitted as compressed values.
Function code 66: Reading new events

The events are stored with 8 bytes in the buffer. The assignment is as follows:
Event number: according to Res-Docu (generated)
Event number
LO
LO
HO
a
ms
ds
s
m
h
HO
Value
a
Time
ms
ds
Low byte
High byte
0 or 1 signal (1 byte)
0...99 milliseconds
0... 9 deciseconds/tenths of seconds
0...59 seconds
0...59 minutes
0...23 hours
The buffer can hold 62 events. A maximum of 8 events (=64 bytes) is

transmitted at the same time.
Buffer overflow is identified by FFFF (Hex). This overflow identification is
also transmitted if applicable. In this case the maximum length is
increased to 66 bytes. The buffer is blocked for new events until the overflow identification is read out. Afterwards new events can be written into
the buffer.
19
BYTE COUNT
0
EXPLANATION
no new events available
<64
response contains all current events
64
it is possible that there are further events in the buffer
Function code 67: last events transmitted

Code 67 is only possible after Code 66, if the master system has not received a correct response to code 66. It makes the slave system repeat its
latest response.
After a new start or buffer overflow of the slave system code 65 should be
sent. In normal operation code 66 resp. 67 has to be sent cyclically by the
master system.
Error messages with event checks

CODE
EXPLANATION
code 67 was not preceeded by code 66
10.1.5 Events Checks via Standard Codes 1,3

The checks realized by the special codes 65, 66, and 67 can also be performed by the standard codes 1 and 3. The following functions are available:
Status check of events via code 1.

Reading out of events (number, status, time) via code 3
The readout of events can also be performed by 2 master systems using

different start addresses during readout. The first master system uses the
start address 3072 and the second the start address 3584. The events are
read out from the same event buffer.
The event variables are defined within the ELOP II (Variable Declaration,
attribute event recorded). A maximum of 1024 event names can be defined.
Status check with CODE 1

From start address 2048 on, the status of the variables defined as events
can be accessed via READ COIL STATUS
20

Request of the master:
Slave
Code
Starting address
HO
xx
Number of events
LO
HO
2048
Check sum
LO
max. 1024
Response of slave as defined in code 1.
Event check with CODE 3

Any bool signal changes of variables can be defined as events in ELOP II
(Variable Declaration). The status of the bool signal in the current cycle is
compared to the status in the previous cycle. If there are changes, the
number of the event, the current status and the time of the PES are stored
in a buffer at the beginning of a cycle. Events recorded in the same cycle
therefore have the same time stamp.
The buffer holds a maximum of 62 events. If more events occur, the buffer
overflow thus caused is identified by 8 bytes FF (hex). New events are taken into the buffer only after the overflow identification has been read.
Each event is stored in the buffer by 8 bytes which have the following meaning:
Event number
LO
HO
Value
Time
ms
ds
The event number is documented in the RES-Docu (generated).

ms
ds
s
m
h
0...99 milliseconds
0...9 deciseconds/tenths of seconds
0...59 seconds
0...59 minutes
0...23 hours
Identification of overflow of event buffer:

All 8 bytes have the value FF(hex).
All events occurred are contained in the answer of the slave or the buffer
is empty:
All 8 bytes of the remaining data of the transmission have the value
EE(hex).
When events are being checked via code 3, as many events are read out
of the buffer (a maximum of 31 events x 4 integer values = max. 31 x 8
bytes) as have been defined in the request of the master system. As one
event consists of 8 bytes, 4 integer variables have to be taken together in
reading.
21

To distinguish the repetition of a request from a new request checking has
to be performed with a minimum of two alternating start addresses during
normal operation.
If an inquiry with the same start address as during the previous check is
received, the latest response is supposed to have been received incorrectly by the master, and therefore the master asks again for the same
events.
When starting communication and after event buffer overflow, we recommend reading the status of all events with code 1.
Start addresses:
1st Master: 3072
2nd Master: 3584
Example
The master system requests the maximum number of events:
1st request/transmission: start address: 3072
number of integer variables: 124
2nd request/transmission: start address: 3073
3rd request/transmission: start address: 3072
The master system requests one event each time:

1st request/transmission: start address: 3072
2nd request/transmission: start address: 3076
number of integer variables 4
3rd request/transmission: start address: 3072
Error messages during event check
22
CODE
EXPLANATION
start address or number of values do not correspond to the

definition.

10.1.6 Time Synchronization, CODE 70
Via MODBUS time and date of PES can be synchronized by a master.
Code 70 is used for this purpose. Via slave address 0 (broadcast), the master addresses all PES. There is no answer.
SLAVE
CODE
BC
70
DATA
ms
time:
date:
ds
ms
ds
s
min
h
d
m
a
min
CRC
h
xx
0...99 milliseconds
0...9 deciseconds
0...59 seconds
0...59 minutes
0...23 hours
1...31 days
1...12 months
0...99 years
If only the time is to be transmitted, d must be set to 0; if only the date is

to be transmitted, ms has to be set to 255.
The time transmitted is the point of time of sending the first character of
this transmission. The time in the slave is corrected by the delay caused
by the transmitting time.
10.1.7 Time Synchronization, CODE 6

The time in the PES can also be set via code 6. For this purpose the telegram with code 6 must contain the number of milliseconds passed since
the last full minute, i.e. the values are in the 0...59999 range. Via slave
address 0 all PES are accessed by the master. There is no answer.
The time transmitted is the point of time of sending the first character of
this transmission. The time in the slave is corrected by the delay caused
by the transmitting time.
10.1.8 Hints on the Operation of the System

The following paragraphs underline some particular features if the system
is coupled with process control systems. We recommend getting some information on the details of the MODBUS coupling.
Communication is only performed in the RUN operating mode of the PES
and exclusively in the RTU mode (Remote Terminal Unit, defined in the
MODBUS reference guide).
The values sent by the master system are processed in the user program
at the beginning of the next cycle, and they are therefore treated as physical inputs. Only when the data are taken over to the variables, the acknowledgement is sent to the master system.
The data requested by the master system are sent directly in the cycle to
the master.
23

The operating system has the following default values:
Way of transmission:RTU
Parity bit:
1 (even)
Baud rate:
9600 Bd or 57600 Bd (DIL
switch on the central module)
Number of stop bits:1
If necessary the baud rate, parity and stop bits can be changed in the settings of the resource.
The slave number is defined by the user who sets the bus subscriber number (encoding switch on the central module).
With some process control systems the counting of the addresses starts
at 1; in the HIMA PES it starts at 0 (according to the definition in the MODBUS reference guide). Take remedial measures with declaration a dummy
BUSCOM variable in the HIMA PES with the adresse 0.
10.2
Coupling with the 3964R Protocol (SIEMENS Devices)

Unlike the MODBUS protocol the SIEMENS 3964R protocol is not designed as a bus system but as a point-to-point connection.
There is the recommendation to order the description of the protocol
3964R at SIEMENS and please inform you about the exceptionals of the
master system.
The HIMA H41q and H51q PES can only be applied as slave systems.
Only the interfaces on the central module (1 or 2) and not the interfaces
on the coprocessor modules can be used for this way of data transmission. Only the data type D (Data Block) of protocol 3964R is supported.
HIMA works with the Block Check Character (BCC) inside the telegram.
The definition of the reading and writing variablen is done the resource
(Variable Declaration) via the attribute Siemens-Protocol.
10.2.1 Overview of the Functions of the 3964R Protocol

Principally, the Siemens 3964R protocol distinguishes between 2
functions:
Writing of variables; SEND request, command AD.

Reading of variables, FETCH request, command ED
It is possible to read or write a maximum number of 128 bytes together.
24

10.2.2 Available Writing Codes
The data are written after a SEND request. The variables are addressed
via data building blocks (DB) and via data words (DW).
Coordination of Bool Variables with Data Building Blocks and Data
Words:
16 bool variables are addressed via one data word.
The addresse are listed in the Resource-Documentation RES-Docu (generated).
Coordination of the integer variables with Data Words:

A integer variable is addressed via one data word.
The addresse are listed in the Resource-Documentation RES-Docu (generated).
10.2.3 Available Reading Codes

The data are read with a FETCH request. The variables are addressed via
data building blocks (DB) and via data words (DW).
10.2.4 Error Codes Transmitted to the Master

0
no error
format error: structure of transmission incorrect,

for example
incorrect check sum
incorrect coordination flag
incorrect identification
incorrect kind of command (not A or E)
incorrect kind of data (not D)
request with data (ED)
write command without data (AD)
no double DLEs
telegram header > 10 bytes
error of address: address indicated is incorrect or

invalid (variables not defined by HIMA)
error of number:
number = 0 or greater than the number of defined variables
or number >128 bytes
25
Diagnostic Display
11 Diagnostic Display
The diagnostic display consists of a four-digit alphanumerical display as
well as two LEDs with IO and CPU identification on the front plate of the
central module of the PES. Via 2 pushbuttons additional information can
be called from the PES. The kind of information is explained below. One
pushbutton is for selecting the next higher or lower level, the other pushbutton is for selection information on the same level.
11.1
Information to be Called during RUN Operation

The CPU and IO LEDs are not lighted up.
Display
Call of the
info
Text
Expl.
BATI
----
voltage buffer battery RAM to low,

on central module
BN
bus subcriber number selection on 1x, 3x

central module
BOOT-ID
BS41q/
51q
V7.0-7
(9737)
26
Explanation
----
CRC of the boot section
4x, 2x
mark of the operating system
4x
version of the operating system

(edition of the operating system)
EPROMCRC
CRC of the operating system verify 4x, 1x

with the value in the safety certificate of the operating system
CB1
CB2
CB3
for internal tests
5x
6x
7x
CODEAC34
VERSION
code version
1x, 1x
C.TIME
0064
cycle time in ms
1x, 4x
DATE
0212
date, day/month
1x, 8x
Diagnostic Display
Display
Text
Expl.
47
iiii
Explanation
display of the last error, see list of

the error code in chapter 11.4
display of the actual error:
ZB/CU: CPU
ZB/CU: MEMORY
ZB/CU: REALTIME CLOCK
ZB/CU: COUPLING UNIT
ZB/CU: CLOCK
LOGIC EMERGENCY OFF
NOISE BLANKING
FATAL ERROR
W-DOG
COUPLING UNIT/OTHER
for internal tests
Call of the
info
1x
1x,
1x, 1x
central module is empty
K-IS
0120
error code for further internal tests
2x
K-SO
0034
3x
KEY
0022
4x
Konfigura- HIMA
tion
configuration name
1x, 2x
MAX170ERR
0013
5x
MONO
----
mono operation with redundant CM
nnnn
1403
display of the last faulty module
RELOAD
----
mono-reload is working
OSLD
*nxy
*1a8
OS-Loader starts up
display during the download
n = 0 or 1, x = 0...F, y = 5, 6, 7, 8
1x
Programm PRO1
program name
1x, 1x
Ressource H51RT
resource name
1x
RUN
PES in normal operation
----
RUN3402
VERSION
RUN-version, creation during ope- 1x, 2x

ration, dependant on all values
SC1 up to
SC 64
0012
safety related communication to

the 1st system (upto 64th system)
no value change: no data
SIO1
0012
interface 1 on CM no value change: 2x

no data for SS1
3x
0012
interface 2 on CM no value change: 2x, 1x,

no data for SS2
2x, 1x, 1x
SIO2
2x,2(-65)x,
2x,2(-65)x,
1x
27
Diagnostic Display
Display
Text
Explanation
Call of the
info
Expl.
STOP
stop by the engineering station,

stop by operating system
TIME
1431
3132
32.3
time in hours/minutes
time in minutes/seconds
time in seconds/deciseconds
1x, 5x
1x, 6x
1x, 7x
>
>
Displayerasing of the application

programfor erasing use
ACK, , simultaneously !
8x
1x
ACK, ,
The values entered are fictitious ones.

If ---- has been entered in the value column only the entries in the text
column are displayed. If a number has been entered in the value column,
the text and the value are displayed alternatingly during operation of the
PES. If the text contains more letters than the four letters visible, it is displayed as running text. A point as running letter is the living sign.
28
Diagnostic Display
11.2
Errors in the Central Area (CPU LED lights up)

Display
Explanation
Text
11.3
DEAD
EXCP
NMI
fatal error at start up

only switching off/on possible
no communication exchange the module
RAMT
CHCK
WAIT
display after switching on until switching on the IOs
STOP
error stop
by error stop through error of output modules, coupling
module and group amplifier, it is possible to call the positions of the IO-modules with pushing two times the button
of the central module to the right side
Errors in the IO Area (IO LED lights up)
Display
Explanation
1024
position of a faulty IO module

04: position in the IO rack
2: number of the IO rack
1: number of the cabinet or the IO-bus
1314/2/4
channel fault of a IO module with line supervision

/2/4: numbers of the faulty channels
14: position in the IO rack
1: number of the cabinet or the IO-bus
14**
fault of the complete IO rack

1: number of the cabinet or IO-bus
It is impossible to address the IO rack (connection cable,
IO-bus, power supply, connection module)
If several IO modules are defective, all IO positions affected including the

IO channels are displayed alternatingly.After the defective module has
been exchanged or the line fault has been repaired, the error display is reset via the ACK button on the central module. Then the IO module resp.
the channel is active again.
Other information can be selected via the two pushbuttons even if the IO
display lights up. If within 20 seconds no new information is requested, the
IO positions are again displayed.
29
Diagnostic Display
11.4
List of Error Codes

The following list contains all error codes. The error codes important for
the operator are explained in more detail. They are displayed in addition
to the above described diagnostic displays after being called via the two
buttons on the front of the central module. The error codes and diagnostic
codes are only interesting as far as further examination by the manufacturer is concerned. If an error occurs, its error code is stored. This error code
is overwritten by a new error code as soon as the next error occurs. Therefore only the latest error is stored. Older error codes can be called with
ELOP II. The error code is deleted only if the central module is loaded with
a new project, or if the central module is deleted and loaded again..
Error code
number
0
1-4
5
no error
error in central module
cycle time exceeded
6-8
9-12
13
outputs are not de-energized during start up of the control

e.g.: input module is inserted in slot, where an output
module is defined
14
logic emergency off
15-16
17
discrepancy in memories which cannot be located
18
tolerable divergence of time bases
19
20-21
time delay of other central module
22-28
29, 30
IO subrack defined does not exist or error in coupling

module
31-39
40-46
47
48-52
53
54-87
88
89-92
93
30
Explanation, cause of the error code
error in power supply monitoring

unknown IO module type (wrong entry in ELOP II)
wrong resource-type selected
signature error in user program
Diagnostic Display
Error code
number
94
95-99

signature error in RWP area
100
occurrence of NMI caused by non- initialized RAM, e.g.

empty CU
101
communication with other central module not possible

or the versions are different
102
time delay received from other central module
103-126
127
128-130

monitoring of program run of HIMA building blocks
131
start up via programmer unit
132
start up after pressing the ACK key on central module
133
start up after self-test
134
start up after switching power on
135
faulty power supply
136, 137
138
139-150
151

time for mono reload exceeded
cycle time exceeded selected watchdog is to small
152-160
161
start after break point
162-167
168-175
code does not exist
176, 177
error in coupling module
178, 179
IO subrack defined does not exist, or error in coupling

module
180, 181
error in IO-power supply
182
183, 184
error in IO-power supply
185
186
code does not exist
187
defined IO-rack does not exist or error in the connection

module
H41q: wrong ressource-type or error in central module
188
start of noise blanking
31
Diagnostic Display
Error code
number
189
190
IO-rack is switched off
191
maintenace switch of F 7553 is pressed
192
193
194-196
code does not exist
197
start of noise blanking
198
code does not exist
199
initialisation of the event buffer
200
code does not exist
201-208
209
faulty F 6213 or F 6214 input module

210-214
code does not exist
215-216
faulty F 3235 input module
217-219
faulty F 3237/38 input module
220-222
faulty F 6705 output module
223-226
faulty F 3330/31/33/34 output module
227-228
faulty F 6217 input module
229
230-239
240
241-252
32
code does not exist

Do not enter a digit on positions 7, 8
of the resource name, will be used only for Ethernet
communication
code does not exist
253
start erasing of the application program
254
erasing of the application program
255
From:
Company:

Documentation
P.O. Box 1261
68777 Brhl
Germany
Name:
Dept.:
Address:
Phone:
Fax:
Date
Dear reader,
we are always eager to keep our manuals up to date and to avoid errors. But if you have found an
error in this manual, or if you want to make suggestions for improvements, also for the HIMA products, we would be very grateful to you.
Please use therefore just this page or a photocopy of it and send it to us by post or by fax.
(Fax No. (+49) 6202 709-123)
Sub.: Functions of the Operating System

TI 99.09E
HIMA
... the safe decision.
TI 99.09E
(9908)

P.O. Box 1261 68777 Brhl Germany
Telephone: (+49 6202) 7 09-0 Telefax: (+49 6202) 7 09-1 07
E-mail: info@hima.com Internet: www.hima.com
0499.10

h41q-h51q Operating System

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

h41q-h51q Operating System

Uploaded by

Copyright:

Available Formats

Programmable Systems

Functions of the Operating System

BS41q/51q V7.0-7 (9906)

HIMA Paul Hildebrandt GmbH + Co KG

Conditions of Supply and Delivery

The Functions of the Operating System . . . . . . . . . . . . . . . 3

Identification of the Operating Systems . . . . . . . . . . . . . . . 5

HIMA - Standard functions . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Overview of the possible couplings . . . . . . . . . . . . . . . . . . 11

Coupling with Other HIMA PES . . . . . . . . . . . . . . . . . . . . .

Coupling with HIMA Master Systems . . . . . . . . . . . . . . . . . 13

Logic Plan Controlled Logging . . . . . . . . . . . . . . . . . . . . . . 14

Coupling with External Systems . . . . . . . . . . . . . . . . . . . .

The Functions of the Operating System

The Functions of the Operating System

Work in the user program

Cyclic work of the user program

Function blocks, functions, variables

HIMA standard building block

Standard building block, variables

Configuration of the PES

Configuration in resource type

Reload of the user program

possible with restrictions

Tests in central area and in IO-bus

Tests of IO-modules (dependant on type)

Reaction with error

Diagnostic mode for testable IO-modules

Software building block HZ-DOS-3

Communication with serial interface

Configuration in resource type

PES-Master, non safety related

Variable Declaration, attributes, HIBUS communication

PES-Master, safety related

Variable Declaration, attributes, safety related

Variable Declaration, external coupling

Software buildingblock HK-MMT-3,

Mastersystems with protocol 3964 R

Variable Declaration, external coupling

logic controlled logging

Variable Declaration, attributes, event - controlled, history

The Functions of the Operating System

512 kByte program

Identification of the Operating Systems

Identification of the Operating Systems

The BS41q/51q Operating System, V7.0-7

BS41q/51q V7.0-7 (9906)

Assignment of the Operating Systems to the

Assignment of the Operating Systems to other Firmware

Operating system CM Ethernet module (EN-BG)

The edtions in bold types are the recommended editions.

Reading the input signals

Processing the logic functions

Writing the output signals

Tests of the IO modules during operation

Data transfer and data comparison

H41q-M, H41q-MS, H41q-HR, H41q-HRS

Processing of all write transmissions

Processing of all write transmissions

transmission of the inputs to the slave

transmission of the inputs to the other central

copy all internal variables to import variables

copy all internal variables to import variables

exchange of the output and comparison