HIMA HIMax X-CPU 01, Manual

Page: 10 / 52

3 Product Description X-CPU 01
Page 10 of 52 HI 801 009 E Rev. 4.00
3 Product Description
The X-CPU 01 processor module is absolutely required for data processing within the
HIMax system. The processor module is used for:
ƒ Processing of up to 32 user programs
ƒ Performing all central functions including communication
ƒ Handling redundancy with up to 3 additional processor modules
ƒ Handling communication via safe ethernet.
ƒ Creating and storing CPU events.
ƒ Storing events created by I/O modules.
The module has been certified by the TÜV for safety-related applications up to SIL 3
(IEC 61508, IEC 61511 and IEC 62061), Cat. 4 (EN 954-1) and PL e (EN ISO 13849-1).
Refer to the HIMax Safety Manual (HI 801 003 E) for more information on the standards
used to test and certify the modules and the HIMax system.
3.1 Safety Function of the Module
The safety function of the processor module includes the following points:
ƒ Processing the user programs.
-
If faults occur: Stop the user program and reset the variables to the initial values
-
If faults occur: Reset the processor module to the safe state and report the CPU
status
ƒ Safe communication between HIMA controllers (HIMax, HIMatrix, and remote I/O
modules) using the safety-related safe etherne t protocol.
Data is transferred using either the Ethernet interfaces of the processor module itself or
using the Ethernet interfaces of a COM module.
The safety function is performed in accordance with SIL 3.
The following elements also contribute to achieving the safety function:
ƒ Hardware self-tests
ƒ
Safe communication with the I/O modules
3.1.1 Reaction in the Event of a Fault
If the test harness detects faults, the processor module enters the ERROR STOP state and
restarts itself. The fault cause can be investigated using the diagnostic information.
Start after an Error Stop
If the cause of the fault is still present, the processor module avoids restarting and
repeating the error stop:
ƒ After a first error stop, the processor module restarts normally and switches to its
system operation.
ƒ After the second error stop, the user must restart the system using the PADT after
eliminating the problem.
ƒ Once the processor module has run in system operation for approximately one minute,
the next error stop to occur is considered to be as first error stop.