HIMA HIMax X-CPU 01 User manual

X-CPU 01
HIMax®
Manual

HI 801 009 E Rev. 4.00 (1117)
All HIMA products mentioned in this manual are protected by the HIMA trade-mark. Unless noted
otherwise, this also applies to other manufacturers and their respective products referred to herein.
All of the instructions and technical specifications in this manual have been written with great care and
effective quality assurance measures have been implemented to ensure their validity. For questions,
please contact HIMA directly. HIMA appreciates any suggestion on which information should be
included in the manual.
Equipment subject to change without notice. HIMA also reserves the right to modify the written material
without prior notice.
For further information, refer to the CD-ROM and our website http://www.hima.de and
http://www.hima.com.
© Copyright 2011, HIMA Paul Hildebrandt GmbH + Co KG
All rights reserved
Contact
HIMA contact details:
HIMA Paul Hildebrandt GmbH + Co KG
P.O. Box 1261
68777 Brühl, Germany
Phone: [phone]
Fax: [phone]
E-mail: [email protected]
Type of Change
Revision
index
Revisions
technical editorial
4.00 New edition for HIMax V4 and SILworX V4 X X

X-CPU 01 Table of Contents
HI 801 009 E Rev. 4.00 Page 3 of 52
Table of Contents
1Introduction ............................................................ 5
1.1 Structure and Use of this Manual......................................................................... 5
1.2 Target Audience..................................................................................................... 5
1.3 Formatting Conventions ....................................................................................... 6
1.3.1 Safety Notes ............................................................................................................ 6
1.3.2 Operating Tips ......................................................................................................... 7
2Safety...................................................................... 8
2.1 Intended Use .......................................................................................................... 8
2.1.1 Environmental Requirements................................................................................... 8
2.1.2 ESD Protective Measures........................................................................................ 8
2.2 Residual Risk ......................................................................................................... 9
2.3 Safety Precautions................................................................................................. 9
2.4 Emergency Information......................................................................................... 9
3Product Description .............................................. 10
3.1 Safety Function of the Module............................................................................ 10
3.1.1 Reaction in the Event of a Fault............................................................................. 10
3.2 Scope of Delivery................................................................................................. 11
3.3 Type Label ............................................................................................................ 11
3.4 Structure ............................................................................................................... 12
3.4.1 Block Diagram, Functional Units............................................................................ 12
3.4.2 Safety-Related Processor System ......................................................................... 13
3.4.3 System Controller .................................................................................................. 13
3.4.4 Memory.................................................................................................................. 13
3.4.5 Alarms and Events................................................................................................. 13
3.4.6 Creating Events ..................................................................................................... 14
3.4.7 Recording Events................................................................................................... 15
3.4.8 Protocols and Interfaces ........................................................................................ 15
3.4.9 Ports in Use for Ethernet Communication.............................................................. 16
3.4.10 Mechanical Structure ............................................................................................. 16
3.4.11 Indicators ............................................................................................................... 17
3.4.12 Module Status Indicators ....................................................................................... 18
3.4.13 Redundancy Indicators .......................................................................................... 19
3.4.14 System Bus Indicators ........................................................................................... 19
3.4.15 Maintenance Indicators.......................................................................................... 20
3.4.16 Fault Indicators ...................................................................................................... 20
3.4.17 Ethernet Indicators................................................................................................. 21
3.4.18 Mode Switch .......................................................................................................... 21
3.4.19 Monitoring the Operating Voltage .......................................................................... 23
3.4.20 Monitoring the Temperature................................................................................... 23
3.4.21 Operating System .................................................................................................. 24

Table of Contents X-CPU 01
Page 4 of 52 HI 801 009 E Rev. 4.00
3.5 Product Data ......................................................................................................... 25
3.6 Connector Board .................................................................................................. 26
3.6.1 Connecting Options................................................................................................26
4Start-up ................................................................. 27
4.1 Mounting ...............................................................................................................27
4.1.1 Slots Permitted for the Processor Module.............................................................28
4.1.2 Mounting a Connector Board .................................................................................28
4.1.3 Mounting and Removing the Module......................................................................31
4.1.4 Configuring the Module in SILWorX ....................................................................... 32
4.1.5 Configuring Events in SILworX............................................................................... 37
4.1.6 User Program .........................................................................................................40
4.1.7 Starting the Processor Module ............................................................................... 40
5Operation .............................................................. 42
5.1 Handling ................................................................................................................42
5.2 Diagnosis ..............................................................................................................42
6Maintenance .......................................................... 43
6.1 Maintenance Measures ........................................................................................43
6.1.1 Loading the Operating System...............................................................................43
6.1.2 Proof Test...............................................................................................................43
7Decommissioning .................................................. 44
8Transport .............................................................. 45
9Disposal ................................................................ 46
Appendix ............................................................... 47
Application Examples .......................................................................................... 47
Glossary ................................................................................................................49
Index of Figures.................................................................................................... 50
Index of Tables .....................................................................................................50
Index ......................................................................................................................51

X-CPU 01 1 Introduction
HI 801 009 E Rev. 4.00 Page 5 of 52
1 Introduction
The present manual describes the technical characteristics of the module and its use. It
provides information on how to install, start up and configure the module in SILworX.
1.1 Structure and Use of this Manual
The content of this manual is part of the hardware description of the HIMax programmable
electronic system.
This manual is organized in the following main chapters:
Introduction
Safety
Product Description
Start-up
Operation
Maintenance
Decommissioning
Transport
Disposal
Additionally, the following documents must be taken into account:
Name Content Document no.
HIMax
System manual
Hardware description of the
HIMax system
HI 801 001 E
HIMax
Safety manual
Safety functions of the HIMax
system
HI 801 003 E
HIMax
Communication manual
Description of communication
and protocols
HI 801 101 E
SILworX Online Help
(OLH)
Instructions on how to use
SILworX
-
First Steps Introduction to SILworX HI 801 103 E
Table 1: Additional Relevant Manuals
The latest manuals can be downloaded from the HIMA website at www.hima.com. The
revision index on the footer can be used to compare the current version of existing manuals
with the Internet edition.
1.2 Target Audience
This document addresses system planners, configuration engineers, programmers of
automation devices and personnel authorized to implement, operate and maintain the
devices and systems. Specialized knowledge of safety-related automation systems is
required.

1 Introduction X-CPU 01
Page 6 of 52 HI 801 009 E Rev. 4.00
1.3 Formatting Conventions
To ensure improved readability and comprehensibility, the following fonts are used in this
document:
Bold: To highlight important parts
Names of buttons, menu functions and tabs that can be clicked and
used in SILworX.
Italics: System parameter and variables
Courier Literal user inputs
RUN Operating state are designated by capitals
Chapter 1.2.3 Cross references are hyperlinks even though they are not
particularly marked. When the cursor hovers over a hyperlink, it
changes its shape. Click the hyperlink to jump to the corresponding
position.
Safety notes and operating tips are particularly marked.
1.3.1 Safety Notes
The safety notes are represented as described below.
These notes must absolutely be observed to reduce the risk to a minimum. The content is
structured as follows:
Signal word: danger, warning, caution, notice
Type and source of danger
Consequences arising from the danger
Danger prevention
The signal words have the following meanings:
Danger indicates hazardous situation which, if not avoided, will result in death or serious
injury.
Warning indicates hazardous situation which, if not avoided, could result in death or
serious injury.
Warning indicates hazardous situation which, if not avoided, could result in minor or
modest injury.
Notice indicates a hazardous situation which, if not avoided, could result in property
damage.
NOTICE
Type and source of damage!
Damage prevention
SIGNAL WORD
Type and source of danger!
Consequences arising from the danger
Danger prevention

X-CPU 01 1 Introduction
HI 801 009 E Rev. 4.00 Page 7 of 52
1.3.2 Operating Tips
Additional information is structured as presented in the following example:
iThe text corresponding to the additional information is located here.
Useful tips and tricks appear as follows:
TIP The tip text is located here.

2 Safety X-CPU 01
Page 8 of 52 HI 801 009 E Rev. 4.00
2 Safety
All safety information, notes and instructions specified in this manual must be strictly
observed. The product may only be used if all guidelines and safety instructions are
adhered to.
This product is operated in accordance with SELV or PELV. No imminent danger results
from the module itself. The use in Ex-Zone is permitted if additional measures are taken.
2.1 Intended Use
HIMax components are designed for assembling safety-related controller systems.
When using the components in the HIMax system, comply with the following general
requirements
2.1.1 Environmental Requirements
Requirement type Range of values
Protection class Protection class III in accordance with IEC/EN 61131-2
Ambient temperature 0...+60 °C
Storage temperature -40...+85 °C
Pollution Pollution degree II in accordance with IEC/EN 61131-2
Altitude < 2000 m
Housing Standard: IP20
Supply voltage 24 VDC
Table 2: Environmental Requirements
Exposing the HIMax system to environmental conditions other than those specified in this
manual can cause the HIMax system to malfunction.
2.1.2 ESD Protective Measures
Only personnel with knowledge of ESD protective measures may modify or extend the
system or replace modules.
NOTE
Device damage due to electrostatic discharge!
When performing the work, make sure that the working area is free of static and
wear an ESD wrist strap.
If not used, ensure that the device is protected from electrostatic discharge, e.g.,
by storing it in its packaging.

X-CPU 01 2 Safety
HI 801 009 E Rev. 4.00 Page 9 of 52
2.2 Residual Risk
No imminent danger results from a HIMax module itself.
Residual risk may result from:
Faults in the engineering
Faults in the user program
Faults in the wiring
2.3 Safety Precautions
Observe all local safety requirements and use the protective equipment required on site.
2.4 Emergency Information
A HIMax controller is a part of the safety equipment of a system. If the controller fails, the
system adopts the safe state.
In case of emergency, no action that may prevent the HIMax systems from operating safely
is permitted.

3 Product Description X-CPU 01
Page 10 of 52 HI 801 009 E Rev. 4.00
3 Product Description
The X-CPU 01 processor module is absolutely required for data processing within the
HIMax system. The processor module is used for:
Processing of up to 32 user programs
Performing all central functions including communication
Handling redundancy with up to 3 additional processor modules
Handling communication via safeethernet.
Creating and storing CPU events.
Storing events created by I/O modules.
The module has been certified by the TÜV for safety-related applications up to SIL 3
(IEC 61508, IEC 61511 and IEC 62061), Cat. 4 (EN 954-1) and PL e (EN ISO 13849-1).
Refer to the HIMax Safety Manual (HI 801 003 E) for more information on the standards
used to test and certify the modules and the HIMax system.
3.1 Safety Function of the Module
The safety function of the processor module includes the following points:
Processing the user programs.
-If faults occur: Stop the user program and reset the variables to the initial values
-If faults occur: Reset the processor module to the safe state and report the CPU
status
Safe communication between HIMA controllers (HIMax, HIMatrix, and remote I/O
modules) using the safety-related safeethernet protocol.
Data is transferred using either the Ethernet interfaces of the processor module itself or
using the Ethernet interfaces of a COM module.
The safety function is performed in accordance with SIL 3.
The following elements also contribute to achieving the safety function:
Hardware self-tests
Safe communication with the I/O modules
3.1.1 Reaction in the Event of a Fault
If the test harness detects faults, the processor module enters the ERROR STOP state and
restarts itself. The fault cause can be investigated using the diagnostic information.
Start after an Error Stop
If the cause of the fault is still present, the processor module avoids restarting and
repeating the error stop:
After a first error stop, the processor module restarts normally and switches to its
system operation.
After the second error stop, the user must restart the system using the PADT after
eliminating the problem.
Once the processor module has run in system operation for approximately one minute,
the next error stop to occur is considered to be as first error stop.

X-CPU 01 3 Product Description
HI 801 009 E Rev. 4.00 Page 11 of 52
3.2 Scope of Delivery
The module must be installed on a suitable connector board to be able to operate. The
connector board is described in Chapter 3.6. An Ethernet cable is required to connect to the
PADT.
Connector boards and Ethernet cables are not included within the scope of delivery of the
module.
3.3 Type Label
The type label specifies the following important details:
Product name
Mark of conformity
Bar code (2D or 1D code)
Part number (Part-No.)
Hardware revision index (HW Rev.)
Software revision index (SW Rev.)
Operating voltage (Power)
Ex specifications (if applicable)
Production year (Prod-Year:)
Figure 1: Sample Type Label

3 Product Description X-CPU 01
Page 12 of 52 HI 801 009 E Rev. 4.00
3.4 Structure
The processor module is a plug-in module that is inserted into a base plate and supplied
with electric power.
Functional units of the module:
Safety-related processor system 1oo2
System controller
Ethernet switch
Memory
Mode switch, see Chapter 3.4.18.
Indicators, see Chapter
3.4.11.
3.4.1 Block Diagram, Functional Units
The following block diagram illustrates the structure of the module.
Mode Switch
1oo2 Processor System
Comparator
Watchdog
System Controller
Ethernet Switch
System Bus A and System Bus B
Figure 2: Block Diagram

X-CPU 01 3 Product Description
HI 801 009 E Rev. 4.00 Page 13 of 52
3.4.2 Safety-Related Processor System
The safety-related processor module is a 1oo2 processor system. Continuous self-tests
ensure safety-related operation.
Characteristics:
Two synchronous microprocessors
Specific DDRAM memory for each microprocessor
Testable hardware comparator for data buses
Watchdog (WD)
Gold capacitor for buffering date/time
LEDs for indicating the system statuses
Mode switch for configuring the module behavior when voltage is switched on
The processor module compares the data on both processors and triggers an interrupt if a
fault occurs.
A watchdog monitors both processors. Self-tests of the module also check the watchdog.
3.4.3 System Controller
The system controller handles the entire data transfer between the various components of
the module:
Safety-related processor system
System busses A and B
Ethernet switch with connected interfaces
3.4.4 Memory
The module has a RAM and a non-volatile memory. The non-volatile memory is protected
by a CRC.
The non-volatile memory contains the following programs and information:
Operating System
User project
Enable switch, watchdog time, safety time
Online modifications
Variable with the RETAIN attribute
Production data and, if necessary, trimming data
Fault status history
Events
While booting, the system transfers the program code from the non-volatile memory to the
redundant program and data memory.
3.4.5 Alarms and Events
The processor module records alarms and other events in its non-volatile memory.
Events are state changes of a variable that are performed by the plant or controllers and
are provided with a timestamp.
Alarms are events that signalize an increasing risk potential.
The HIMax system records the state changes as events specifying the time point when they
occurred. The X-OPC server transfers the events to other systems such as control
systems, that display or evaluate the events.
HIMax differentiate between Boolean and scalar events.

3 Product Description X-CPU 01
Page 14 of 52 HI 801 009 E Rev. 4.00
Boolean Events:
Changes of Boolean variables, e.g., of digital inputs.
Alarm and normal state: They can be arbitrarily assigned to the variable states.
Scalar Events:
Exceedance of the limit values defined for a scalar variable.
Scalar variables have a numeric data type e.g., INT, REAL.
Two upper limits and two lower limits are possible.
For the limit values, the following condition must be met:
Highest limit ≥upper limit ≥normal area ≥lower limit ≥lowest limit.
An hysteresis can be effective in the following cases:
-If the value falls below the upper limit.
-If the value exceeds the lower limit.
An hysteresis is defined to avoid a needless large number of events when a global variable
strongly oscillate around a limit.
The processor module can only create events if they are configured in SILworX, see
Chapter 4.1.5.
3.4.6 Creating Events
Both the processor module and certain types of I/O modules are able to create events. In
the following sections, these I/O modules are referred to as SOE modules.
Creating Events on the Processor Module
The processor module uses global variables to create the events and stores them in the
buffer, see Chapter 3.4.7. The events are created in the user program cycle.
Creating Events on SOE Modules
SOE modules can create events using the input states. The events are created in the SOE
module cycle.
The SOE module stores the events in the intermediate buffer that the processor modules
use to read them. The intermediate buffer is part of the volatile memory so that the events
are lost if the power is switched off.
Every event that has be read can be overwritten by a new event.
System Events
In addition to events, which records changes of global variables or input signals, processor
and SOE modules creates the following types of system events:
Overflow: Some events were not stored due to buffer overflow. The timestamp of the
overflow event corresponds to that of the event causing the overflow.
Init: The event buffer was initialized.
Operating mode Stop: A SOE module changed its operating mode to STOP.
Operating mode 'Run': A SOE module changed its operating mode to Run.
Establishing communication: Communication between processor module and SOE
module has started.
Losing communication: Communication between processor module and SOE module
was terminated.
System events contain the SRS identifier of the module causing the events.
Status Variables
Status variables provide the user program with the state of scalar events. Each of the
following states is connected to a status variable and can be assigned a global variable of
type BOOL:
Normal.

X-CPU 01 3 Product Description
HI 801 009 E Rev. 4.00 Page 15 of 52
Lower limit exceeded.
Lowest limit exceeded.
High limit exceeded.
Highest limit exceeded.
The assigned status variable becomes TRUE when the corresponding state is achieved.
3.4.7 Recording Events
The processor module collects the events:
created by I/O modules
created by the processor module itself
The processor module stores all the events in its buffer. The buffer is part of the non-
volatile memory.and has a capacity of 5 000 events.
The processor module arranges the events from different sources by the time of their arrival
and does not sort them by their timestamp.
If the event buffer is full, no new events can be stored as long as no further events are read
and thus marked as to be overwritten.
The OPC server can read the events and make them available to external systems for
evaluation and storing.
3.4.8 Protocols and Interfaces
Communication with external systems occurs via the Ethernet interfaces. The interfaces are
part of a 10/100/1000 BaseT switch.
The four RJ-45 connectors are located on the connector board. The LEDs on the front plate
of the module indicate the connections statuses. For more information, see Chapter 3.4.11.
On these interfaces, the module can process the following protocols:
The safety-related protocol safeethernet
Connection to the PADT
Parameter Value
Number of connectors 4
Transfer standard 10/100/1000 Base-T, half and full duplex
Auto negotiation Yes
Auto crossover Yes
Connection socket RJ-45
IP Address Freely configurable1)
Subnet Mask Freely configurable1)
Supported protocols safeethernet, PADT
1) Observe the general rules valid for assigning IP address and subnet masks.
Table 3: Specifications for the Ethernet Interfaces
The MAC address of the module is specified on the label on the lower part of the front
plate.

3 Product Description X-CPU 01
Page 16 of 52 HI 801 009 E Rev. 4.00
3.4.9 Ports in Use for Ethernet Communication
UDP ports Use
8000: Programming and operation with SILworX
8001: Configuring the remote I/O using the PES
6010: safeethernet
123: SNTP (time synchronization between PES and remote I/O, PES and external
devices)
Table 4: Ports in Use
3.4.10 Mechanical Structure
Figure 3: Mechanical Structure

X-CPU 01 3 Product Description
HI 801 009 E Rev. 4.00 Page 17 of 52
3.4.11 Indicators
The following figure shows the LED indicators for the processor module. These LEDs are
located on the front plate, on the upper part of the module. The mode switch described in
Chapter 3.4.18 is also located on the front plate of the module.
Figure 4: Front View with LEDs and Mode Switch

3 Product Description X-CPU 01
Page 18 of 52 HI 801 009 E Rev. 4.00
The LEDs indicate the operating state of the processor module. All LEDs should be
considered together. The LEDs on the module are divided into six groups:
Module status indicators (Run, Error, Stop, Init)
Redundancy indicators (Ess, Red)
System bus indicators (A, B)
Maintenance indicators (Force, Test, Prog)
Fault indicators (System, Field, Com)
Ethernet indicators (Eth1...4, H/F/Col1...4)
When the supply voltage is switched on, a LED test is performed and all LEDs briefly flash
simultaneously.
Definition of Blinking Frequencies
The following table defines the blinking frequencies of the LEDs:
Name Blinking Frequencies
Blinking1 Long (approx. 600 ms) on, long (approx. 600 ms) off
Blinking2 Short (approx. 200 ms) on, short (approx. 200 ms) off, short (approx. 200
ms) on, long (approx. 600 ms) off
Blinking-x Ethernet communication: Flashing in sync with data transfer
Table 5: Blinking Frequencies of LEDs
3.4.12 Module Status Indicators
These LEDs are located on the front plate, on the upper part of the module.
LED Color Status Description
On Module in RUN, normal operation
Blinking1 Module state:
STOP/OS_DOWNLOAD or
OPERATE (only with processor modules)
Run Green
Off Module not in RUN,
observe the other status LEDs
On/Blinking1 Internal module faults detected by self-tests, e.g.,
hardware, software or voltage supply.
Fault while loading the operating system
Error Red
Off Normal operation
On Module state:
STOP / VALID CONFIGURATION
Blinking1 Module state:
STOP / INVALID CONFIGURATION or
STOP / OS_DOWNLOAD
Stop Yellow
Off Module not in STOP, observe the other status LEDs
On Module state: INIT, observe the other status LEDs
Blinking1 Module state: LOCKED, observe to the other status
LEDs
Init Yellow
Off Module state: neither INIT nor LOCKED, observe
the other status LEDs
Table 6: Module Status Indicators

X-CPU 01 3 Product Description
HI 801 009 E Rev. 4.00 Page 19 of 52
3.4.13 Redundancy Indicators
LED Color Status Description
On Do not remove the module!
The module is absolutely required for operating the
HIMax system. Only one module is configured.
Blinking1 Do not remove the module!
The module is absolutely required for operating the
HIMax system. Multiple redundant modules are
configured.
Ess Yellow
Off The module is not absolutely required for operation. It
may be removed, if required.
On The module is operating redundantly with at least one
additional module.
Blinking1 At least one processor module starts system operation
or less modules than planned are operating
redundantly.
Red Yellow
Off The module is not operating redundantly.
Table 7: Redundancy Indicators
3.4.14 System Bus Indicators
The system bus LEDs are labeled Sys Bus.
LED Color Status Description
On Physical and logical connection to the system bus
module in slot 1.
Green
Blinking1 No physical connection to the system bus module in
slot 1.
A
Yellow Blinking1
The physical connection to the system bus module
in slot 1 has been established.
No connection to a (redundant) processor module
running in system operation.
On Physical and logical connection to the system bus
module in slot 2.
Green
Blinking1 No physical connection to the system bus module in
slot 2.
B
Yellow Blinking1
The physical connection to the system bus module
in slot 2 has been established.
No connection to a (redundant) processor module
running in system operation.
A+B Off Off Neither physical nor logical connection to the
system bus modules in slot 1 and slot 2.
Table 8: System Bus Indicators

3 Product Description X-CPU 01
Page 20 of 52 HI 801 009 E Rev. 4.00
3.4.15 Maintenance Indicators
The maintenance LEDs are labeled Maint.
LED Color Status Description
On Forcing prepared, processor module in STOP, RUN
or RUN / UP STOP
Blinking1 Forcing active, processor module in RUN or
OPERATE
Force Yellow
Off Forcing inactive
On Connection to the PADT with write permission
Blinking1 At least one user program is in the RUN_FREEZE
state (single step operation)
Test Yellow
Off No connection to the PADT with write access and
no user program in the RUN_FREEZE state
On Download (processor module in STOP), the
configuration is being loaded,
A PADT write command is being processed
Blinking1 Reload procedure active or exchange of
configuration data between processor modules
Prog Yellow
Off No loading procedure active and no configuration
data exchange between processor modules
Table 9: Maintenance Indicators
3.4.16 Fault Indicators
The fault LEDs are labeled Fault.
LED Color Status Description
On System warning, only if no module fault occurred in a
HIMax system module.
Blinking1 Faults detected in a HIMax system module, e.g.,
hardware, software, over temperature or power supply.
The module or base plate is missing or does not match
the configuration or cannot be operated as intended.
System Red
Off No module fault displayed for a HIMax system module
On Field warning, only if no field fault occurred in a HIMax
system I/O module
Blinking1 Field faults in an I/O module of the HIMax system
Field Red
Off No field faults displayed for an I/O module in the
HIMax system
On COM warning, only if no faults occurred in the external
process data communication
Blinking1 Fault in the external process data communication
Com Red
Off No faults displayed for the external process data
communication
Table 10: Fault Indicators