d

HIMax ®

Maintenance Manual

MAINTENANCE
All HIMA products mentioned in this manual are protected by the HIMA trade-mark. Unless noted
otherwise, this also applies to other manufacturers and their respective products referred to herein.
All of the instructions and technical specifications in this manual have been written with great care and
effective quality assurance measures have been implemented to ensure their validity. For questions,
please contact HIMA directly. HIMA appreciates any suggestion on which information should be
included in the manual.
Equipment subject to change without notice. HIMA also reserves the right to modify the written material
without prior notice.
For further information, refer to the HIMA DVD and our website http://www.hima.de and
http://www.hima.com.

© Copyright 2010, HIMA Paul Hildebrandt GmbH + Co KG

All rights reserved

Contact
HIMA Address
HIMA Paul Hildebrandt GmbH + Co KG
P.O. Box 1261
68777 Brühl, Germany
Tel: +49 6202 709-0
Fax: +49 6202 709-107
E-mail: info@hima.com

Revision Revisions Type of Change

index technical editorial
1.00 First issue

HI 801 171 E Rev. 1.00 (1033)

Maintenance Table of Contents

Table of Contents
1 Introduction ............................................................ 5
2 Operating and Servicing Activities .......................... 6
3 Other Applicable Documents ................................... 7
4 Proof Test ............................................................... 8
4.1 Proof Test Execution ............................................................................................. 8
4.2 Frequency of Proof Tests...................................................................................... 8
5 Maintenance Actions, in Details .............................. 9
5.1 Replacing System Fans......................................................................................... 9
5.2 Maintenance Actions for Modules........................................................................ 9
5.2.1 Replacing the Module .............................................................................................. 9
5.2.1.1 Prior to Replacing Redundant Modules ................................................................... 9
5.2.1.2 Prior to Replacing Non-Redundant Modules ........................................................... 9
5.2.2 Mounting and Removing the Module ..................................................................... 10
5.2.3 Loading the Operating System .............................................................................. 11
5.2.4 Maintenance Indicators.......................................................................................... 12
5.3 Field Termination Assemblies ............................................................................ 12
5.4 Base Plate............................................................................................................. 13
Appendix ............................................................... 15
Index of Figures ................................................................................................... 15
Index of Tables..................................................................................................... 15

HI 801 171 E Rev. 1.00 Page 3 of 16

Table of Contents Maintenance

Page 4 of 16 HI 801 171 E Rev. 1.00

Maintenance 1 Introduction

1 Introduction
This document describes the most important activities for servicing or operating a safety-
related HIMax controller.
ƒ Chapter 2 provides a table with the overview of the activities.
ƒ Chapter 3 specifies the relevant manuals and other documents.
ƒ Chapter 4 describes the proof test.
ƒ Chapter 5 describes in detail the required maintenance actions and provides references
to further documents.

HI 801 171 E Rev. 1.00 Page 5 of 16

2 Operating and Servicing Activities Maintenance

2 Operating and Servicing Activities

No Activity Period Reference Per- Notes
. (Table 2) formed
by 1)
1 Access protection (security) Always - A
Mechanical test (visual inspection)
2 Are the modules screwed tightly? Yearly - C, A, O
3 Are the cable plugs screwed tightly? Yearly - C, A, O
4 Are the data connection cables (com- Yearly - C, A, O
munication modules) screwed tightly?
Power supply test
5 Check 230 VAC/24 VDC Yearly - C, A, O
6 Check 24 VDC distribution Yearly - C, A, O
7 Functionality with redundant supply Yearly - C, A, O
Proof Test
8 Loop test including the I/O modules ≤ 10 years D2 C, A, O
within the PES Chapter 4
The modules used for safety-related application must be subjected to a proof
test at regular intervals (refer to IEC/EN 61508-4, Section 3.8.5)
Hardware change/extension/test
9 Replacement of the modules If required D1, D2, D5 C, A, O
Chapter
5.2.1, 5.2.2
10 Replacement of the system fans D4 C, A, O
At an operating temperature of Every 6 years Chapter 5.1
≤ 40 °C
At an operating temperature of Every 3 years
> 40 °C
Software change/extension/test
11 Load and deletion of the user program If required D3 C, A, O
12 Operating system download If required D3, C, A, O
Chapter
5.2.3
13 Change of the system parameter set- If required D1 C, A, O
tings D5
1) C: operating Company, A: Assembler, O: Other
Table 1: Required Operating and Maintenance Activities

Only personnel with knowledge of ESD protective measures may modify or extend the
system or replace modules.

NOTE
Device damage due to electrostatic discharge!
ƒ When performing the work, make sure that the workspace is free of static, and
wear an ESD wrist strap.
ƒ If not used, ensure that the device is protected from electrostatic discharge, e.g.,
by storing it in its packaging.

Page 6 of 16 HI 801 171 E Rev. 1.00

Maintenance 3 Other Applicable Documents

3 Other Applicable Documents

Ref. Standard/Document Description
N1 IEC 61511-1, Section 12 Functional safety -
Safety instrumented systems for the process industry sec-
tor
Framework, definitions, system, hardware and software
requirements
D1 HI 801 001 E HIMax System Manual
D2 HI 801 003 E HIMax Safety Manual
D3 - SILworX Online Help
D4 HI 801 033 E X-FAN Manual
D5 Module Manuals
HI 801 025 E HIMax X-BASE PLATE 01 Manual
HI 801 021 E HIMax X-AI 32 01 Module Manual
HI 801 055 E HIMax X-AI 32 02 SOE Module Manual
HI 801 111 E HIMax X-AO 16 01 Module Manual
HI 801 113 E HIMax X-CI 24 01 Module Manual
HI 801 011 E HIMax X-COM 01 Module Manual
HI 801 009 E HIMax X-CPU 01 Module Manual
HI 801 057 E HIMax X-DI 16 01 Module Manual
HI 801 015 E HIMax X-DI 32 01 Module Manual
HI 801 017 E HIMax X-DI 32 02 Module Manual
HI 801 059 E HIMax X-DI 32 03 Module Manual
HI 801 057 E HIMax X-DI 32 04 SOE Module Manual
HI 801 053 E HIMax X-DI 32 05 SOE Module Manual
HI 801 093 E HIMax X-DI 64 01 Module Manual
HI 801 023 E HIMax X-DO 12 01 Module Manual
HI 801 099 E HIMax X-DO 12 02 Module Manual
HI 801 019 E HIMax X-DO 24 01 Module Manual
HI 801 095 E HIMax X-DO 24 02 Module Manual
HI 801 097 E HIMax X-DO 32 01 Module Manual
HI 801 007 E HIMax X-SB 01 Module Manual
HI 801 115 E HIMax X-FTA 001 01 Manual
HI 801 131 E HIMax X-FTA 001 02 Manual
HI 801 117 E HIMax X-FTA 002 01 Manual
HI 801 119 E HIMax X-FTA 002 02 Manual
HI 801 121 E HIMax X-FTA 003 02 Manual
HI 801 125 E HIMax X-FTA 005 02 Manual
HI 801 127 E HIMax X-FTA 006 01 Manual
HI 801 129 E HIMax X-FTA 006 02 Manual
HI 801 133 E HIMax X-FTA 007 02 Manual
HI 801 135 E HIMax X-FTA 008 02 Manual
HI 801 137 E HIMax X-FTA 009 02 Manual
Table 2: Valid Documentation

HI 801 171 E Rev. 1.00 Page 7 of 16

4 Proof Test Maintenance

4 Proof Test
The proof test reveals dangerous undetected faults that could otherwise affect the safe
function of the system.
HIMA safety systems must be subjected to a proof test in intervals of 10 years. It is often
possible to extend this interval using the a calculation tool to analyze the implemented
safety loops.

4.1 Proof Test Execution

The proof test execution depends on the following factors:
ƒ Plant characteristics (EUC = equipment under control)
ƒ Plant's intrinsic risk potential
ƒ The standards applicable to the plant operation and required for approval by the
responsible test authority.
According to IEC 61508 1-7, IEC 61511 1-3, IEC 62061 and VDI/VDE 2180 sheets 1 to 4,
the operator of the safety-related systems is responsible for performing the proof tests.

4.2 Frequency of Proof Tests

The HIMA PES can be proof tested by executing the full safety loop.
In practice, shorter proof test intervals are required for the input and output field devices
(e.g., every 6 or 12 months) than for the HIMA controller. Testing the entire safety loop
together with a field device automatically includes the test of the HIMA controller. There is
therefore no need to perform additional proof tests of the HIMA controller.
If the proof test of the field devices does not include the HIMA controller, the HIMA
controller must be tested at least once every 10 years. This can be achieved by restarting
the HIMA controller.
Additional proof test requirements for specific modules are described in the manual of the
corresponding module.

Page 8 of 16 HI 801 171 E Rev. 1.00

Maintenance 5 Maintenance Actions, in Details

5 Maintenance Actions, in Details

This chapter describes the maintenance actions for the components of the HIMax system.

Only qualified personnel may perform maintenance actions to supply, signal and data lines,
i taking all ESD protection measures into account. Personnel must be electrostatically
discharged prior to any direct contact with these supply ore signal lines!

5.1 Replacing System Fans

The frequency with which the system fans are replaced depends on the operating
temperature.
HIMA recommends observing the instructions for replacing the system fans and sending
them back to HIMA for overhauling:

Refer to the manual of the system fan (HI 801 033 E) for more details.

5.2 Maintenance Actions for Modules

Perform the following maintenance actions for modules:
ƒ If the module fails, observe the instructions specified below to replace it:
ƒ Operating system download
ƒ Proof test, see Chapter 4

For further details of maintenance actions, refer to the corresponding module manual.

5.2.1 Replacing the Module

If failures occur, the defective module must be replaced with a faultless module of the same
type or with an approved replacement model.
When replacing modules, observe the instructions specified in the System Manual
(HI 801 001 E) and Safety Manual (HI 801 003 E).
Chapter 5.2.2 describes the procedure for replacing modules.
5.2.1.1 Prior to Replacing Redundant Modules
The HIMax system allows one to operate modules redundantly. If at least one redundant
module has been configured for the module to be replaced, the complete system operability
can be ensured during the module replacement.
Make sure that the redundant module is not disturbed during operation. To this end,
observe the LED indicators:
ƒ The FAULT LED must not be lit.
ƒ The RUN LED must be lit.
If these conditions cannot be ensured, observe the procedure for replacing non-redundant
modules.
5.2.1.2 Prior to Replacing Non-Redundant Modules
A part of the controller's functions or the entire controller may be put out of operation by
removing a non-redundant module. Usually, a part of the functions is no longer available
due to the module failure.
Prior to replacing the module, take the consequences of the replacement on the entire
process into account. If necessary, further technical and organizational measures must be
taken to ensure that the process during the module replacement is sufficiently monitored in
terms of safety.

HI 801 171 E Rev. 1.00 Page 9 of 16

5 Maintenance Actions, in Details Maintenance

For more information refer to the TÜV document Maintenance Override.

This document is available on the TÜV homepage:
http://www.tuv-fs.com or
http://www.tuvasi.com.

5.2.2 Mounting and Removing the Module

This chapter describes how to mount and remove the HIMax module. A module can be
mounted and removed while the HIMax system is operating.

NOTE
Damage to bus and power sockets due to module jamming!
Failure to observe this can damage the controller.
Always take care when inserting the module in the base plate.

Tools and utilities

ƒ Screwdriver, slotted 0.8 x 4.0 mm
ƒ Screwdriver, slotted 1.2 x 8.0 mm

Installation
1. Open the cover plate on the fan rack:
; Move the locks to the open position.
; Lift the cover plate and insert into the fan rack
2. Insert the top of the module into the hook-in rail, see .
3. Swivel the lower edge of the module towards the base plate and apply light pressure to
snap it into place, see .
4. Tighten the screws, see .
5. Pull the cover plate out of the fan rack and close it.
6. Lock the cover plate.

Removal
1. Open the cover plate on the fan rack:
; Move the locks to the open position.
; Lift the cover plate and insert into the fan rack
2. Release the screw .
3. Swivel the lower edge of the module away from the base plate. Lift and apply light
pressure to remove the module from the hook-in rail, see and .
4. Pull the cover plate out of the fan rack and close it.
5. Lock the cover plate.

Page 10 of 16 HI 801 171 E Rev. 1.00

Maintenance 5 Maintenance Actions, in Details

Inserting and Removing a Module Securing and Releasing a Module

Swiveling a Module in and out

Figure 1: Mounting and Removing a Module

If the HIMax system is operating, do not open the cover plate of the fan rack for more than
i a few minutes (< 10 min) since this affects the forced cooling.

5.2.3 Loading the Operating System

HIMA is continuously improving the operating system of the module. HIMA recommends to
use system downtimes to load the current version of the operating system into the module.
For detailed instructions on how to load the operating system, see the System Manual
(HI 801 001 E) and SILworX online help. The module must be in STOP to be able to load
an operating system.

The current version of the module in use is displayed in the SILworX Control Panel or on
i the type label!

If the module to be loaded is a system module or a processor module the Ess LED must
not be lit.

HI 801 171 E Rev. 1.00 Page 11 of 16

5 Maintenance Actions, in Details Maintenance

The operating system may be loaded during operation if a redundant module has been
configured for the module to be replaced. Observe the following instructions:
ƒ The redundant module must be in the RUN state.
- The FAULT LED must not be lit.
- The RUN LED must be lit
ƒ The displayed watchdog buffer time must be sufficiently high to allow the transfer of the
operating system.

5.2.4 Maintenance Indicators

The maintenance LEDs are labeled Maint.
LED Color Status Description
Force Yellow On Forcing prepared, processor module in STOP, RUN
or OPERATE
Blinking1 Forcing active, processor module in RUN or OPER-
ATE
Off Forcing inactive
Test Yellow On Connection to the PADT with write permission
Blinking1 One user program is in RUN_FREEZE, (single step
operation)
Off No connection to the PADT with write permission
Prog Yellow On Download (processor module in STOP), the configu-
ration is being loaded
Blinking1 Reload procedure active or exchange of configura-
tion data between processor modules
Off No loading procedure active and no configuration
data exchange on the processor module
Table 3: Maintenance Indicators

With processor modules, these LEDs indicate that the PADT is being used and the type of
action performed with the PADT. It can thus be recognized if software maintenance actions
such as change, extension or test are being performed on the processor modules.

5.3 Field Termination Assemblies

The field termination assemblies are maintenance free. Only if a failure occurs, the
defective field termination assembly must be replaced with a one of the same type or with
an approved replacement model.
While a field termination assembly is being replaced, the connected sensors or actuators
are not available. A part of the sensors or actuators were already disturbed due to the
failure.
ƒ If redundant sensors or actuators were configured for the connected sensors or
actuators, the complete system operability can be ensured during replacement. This
applies if the following conditions are met:
- The connection between the redundant sensors or actuators and the processor
module is not disturbed.
- Separated field termination assemblies are used to connect the redundant sensors or
actuators.
ƒ If not all the sensors or actuators have been redundantly configured, take the
consequences of the replacement on the entire process into account. If necessary,
further technical and organizational measures must be taken to ensure that the process
during replacement is sufficiently monitored in terms of safety.
Refer to the manual of the corresponding field termination assembly for more details.

Page 12 of 16 HI 801 171 E Rev. 1.00

Maintenance 5 Maintenance Actions, in Details

5.4 Base Plate

If defective, the base plate must be replaced. The replacement may cause the system
busses to other base plates to be interrupted. For this reason, prior to replacing the base
plates, think about the consequences that the replacement may have on the entire process
in terms of safety and availability. With this in mind, the following actions must be planned:
ƒ When the replacement should be performed (point in time).
ƒ Technical and organizational measures that must be taken to ensure that the process
during replacement is sufficiently monitored in terms of safety.
Refer to the manual of the base plate (HI 801 025 E) for more details.

HI 801 171 E Rev. 1.00 Page 13 of 16

5 Maintenance Actions, in Details Maintenance

Page 14 of 16 HI 801 171 E Rev. 1.00

Maintenance Appendix

Appendix
Index of Figures
Figure 1: Mounting and Removing a Module 11

Index of Tables
Table 1: Required Operating and Maintenance Activities 6
Table 2: Valid Documentation 7
Table 3: Maintenance Indicators 12

HI 801 171 E Rev. 1.00 Page 15 of 16

HI 801 171 E
© 2010 HIMA Paul Hildebrandt GmbH + Co KG
HIMax and SILworX are registered trademark of:
HIMA Paul Hildebrandt GmbH + Co KG

Albert-Bassermann-Str. 28
68782 Brühl, Germany
Tel. +49 6202 709-0
Fax +49 6202 709-107
HIMax-info@hima.com
www.hima.com