HIMA HIMatrix F3 DIO 8/8 01 User manual

HIMatrix
Safety-Related Controller
F3 DIO 8/8 01 Manual
HIMA Paul Hildebrandt GmbH + Co KG
Industrial Automation
Rev. 2.00 HI 800 179 E

HI 800 179 E Rev. 2.00 (1334)
All HIMA products mentioned in this manual are protected by the HIMA trade-mark. Unless noted otherwise,
this also applies to other manufacturers and their respective products referred to herein.
HIMax®, HIMatrix®, SILworX®, XMR®and FlexSILon®are registered trademarks of HIMA Paul Hildebrandt
GmbH + Co KG.
All of the instructions and technical specifications in this manual have been written with great care and
effective quality assurance measures have been implemented to ensure their validity. For questions, please
contact HIMA directly. HIMA appreciates any suggestion on which information should be included in the
manual.
Equipment subject to change without notice. HIMA also reserves the right to modify the written material
without prior notice.
For further information, refer to the HIMA DVD and our website at http://www.hima.de and
http://www.hima.com.
© Copyright 2013, HIMA Paul Hildebrandt GmbH + Co KG
All rights reserved
Contact
HIMA contact details:
HIMA Paul Hildebrandt GmbH + Co KG
P.O. Box 1261
68777 Brühl, Germany
Phone: [phone]
Fax: [phone]
E-mail: [email protected]
Type of change
Revision
index
Revisions
technical editorial
1.00 Added: Configuration with SILworX X X
1.01 Deleted: Chapter Monitoring the Temperature State integrated in
the system manual
X
2.00 Revised: Chapters 3.4.1 and 3.4.2.1
Added: F3 DIO 8/8 014, SIL 4 certified according to EN 50126,
EN 50128 and EN 50129, Chapter 4.1.4
X X

F3 DIO 8/8 01 Table of Contents
HI 800 179 E Rev. 2.00 Page 3 of 52
Table of Contents
1Introduction 5
1.1 Structure and Use of this Manual 5
1.2 Target Audience 6
1.3 Formatting Conventions 7
1.3.1 Safety Notes 7
1.3.2 Operating Tips 8
2Safety 9
2.1 Intended Use 9
2.1.1 Environmental Requirements 9
2.1.2 ESD Protective Measures 9
2.2 Residual Risk 10
2.3 Safety Precautions 10
2.4 Emergency Information 10
3Product Description 11
3.1 Safety Function 11
3.1.1 Safety-Related Digital Inputs 11
3.1.1.1 Reaction in the Event of a Fault 12
3.1.1.2 Line Control 12
3.1.2 Safety-Related Digital Outputs 13
3.1.2.1 Line Diagnosis 14
3.1.2.2 Reaction in the Event of a Fault 15
3.1.3 Pulsed Outputs 15
3.2 Equipment, Scope of Delivery 16
3.2.1 IP Address and System ID (SRS) 16
3.3 Type Label 17
3.4 Assembly 18
3.4.1 LED Indicators 19
3.4.1.1 Operating Voltage LED 19
3.4.1.2 System LEDs 19
3.4.1.3 Communication LEDs 20
3.4.1.4 I/O LEDs 20
3.4.2 Communication 21
3.4.2.1 Connections for Ethernet Communication 21
3.4.2.2 Network Ports Used for Ethernet Communication 21
3.4.3 Reset Key 22
3.5 Product Data 23
3.5.1 Product Data F3 DIO 8/8 014 25
3.6 Certified HIMatrix F3 DIO 8/8 01 25
4Start-up 26
4.1 Installation and Mounting 26
4.1.1 Connecting the Digital Inputs 26

Table of Contents F3 DIO 8/8 01
Page 4 of 52 HI 800 179 E Rev. 2.00
4.1.1.1 Surges on Digital Inputs 26
4.1.2 Connecting the Digital Outputs 27
4.1.3 Connecting Pulsed Outputs 27
4.1.4 Cable Plugs 28
4.1.5 Mounting the F3 DIO 8/8 01 in Zone 2 29
4.2 Configuration 30
4.3 Configuration with SILworX 30
4.3.1 Parameters and Error Codes for the Inputs and Outputs 30
4.3.2 Digital Inputs of F3 DIO 8/8 01 31
4.3.2.1 Tab: Module 31
4.3.2.2 Tab: DO 8 LC: Channels 32
4.3.3 Digital Outputs of F3 DIO 8/8 01: DO 2 02 33
4.3.3.1 Tab: Module 33
4.3.3.2 Tab: DO 2 02: DO1 Channels 34
4.3.3.3 Tab: DO 2 02: DO2 Channels 34
4.3.4 Digital Outputs of F3 DIO 8/8 01: DO 2 01 35
4.3.4.1 Tab: Module 35
4.3.4.2 Tab: DO 2 01: DO1 Channels 36
4.4 Configuration with ELOP II Factory 37
4.4.1 Configuring the Inputs and Outputs 37
4.4.2 Signals and Error Codes for the Inputs and Outputs 37
4.4.3 Digital Inputs of F3 DIO 8/8 01 38
4.4.4 Digital Outputs of F3 DIO 8/8 01, DO+ (DO1), DO- (DO2) 39
4.4.5 Pulsed Outputs for F3 DIO 8/8 01 40
5Operation 41
5.1 Handling 41
5.2 Diagnosis 41
6Maintenance 42
6.1 Faults 42
6.2 Maintenance Measures 42
6.2.1 Loading the Operating System 42
6.2.2 Proof Test 42
7Decommissioning 43
8Transport 44
9Disposal 45
Appendix 47
Glossary 47
Index of Figures 48
Index of Tables 49
Index 50

F3 DIO 8/8 01 1 Introduction
HI 800 179 E Rev. 2.00 Page 5 of 52
1 Introduction
This manual describes the technical characteristics of the device and its use. It provides
information on how to install, start up and configure the module.
1.1 Structure and Use of this Manual
The content of this manual is part of the hardware description of the HIMatrix programmable
electronic system.
This manual is organized in the following main chapters:
Introduction
Safety
Product Description
Start-up
Operation
Maintenance
Decommissioning
Transport
Disposal
HIMatrix remote I/Os are available for the programming tools SILworX and ELOP II Factory.
Which programming tool can be used, depends on the processor operating system of the
HIMatrix remote I/O, refer to the following table:
Programming tool Processor operating system
SILworX CPU OS V7 and higher
ELOP II Factory CPU OS up to V6.x
Table 1: Programming Tools for HIMatrix Remote I/Os
In the manual, the differences are specified by using:
Separated chapters
Tables differentiating among the versions
iProjects created with ELOP II Factory cannot be edited with SILworX, and vice versa!
iCompact controllers and remote I/Os are referred to as devices.

1 Introduction F3 DIO 8/8 01
Page 6 of 52 HI 800 179 E Rev. 2.00
Additionally, the following documents must be taken into account:
Name Content Document number
HIMatrix System Manual
Compact Systems
Hardware description of the HIMatrix
compact systems
HI 800 141 E
HIMatrix System Manual
Modular System F60
Hardware description of the HIMatrix
modular system
HI 800 191 E
HIMatrix Safety Manual Safety functions of the HIMatrix system HI 800 023 E
HIMatrix Safety Manual for
Railway Applications
Safety functions of the HIMatrix system
using the HIMatrix in railway
applications
HI 800 437 E
SILworX Online Help Instructions on how to use SILworX -
ELOP II Factory
Online Help
Instructions on how to use ELOP II
Factory, Ethernet IP protocol
-
SILworX First Steps Introduction to SILworX using the
HIMax system as an example
HI 801 103 E
ELOP II Factory First Steps Introduction to ELOP II Factory HI 800 006 E
Table 2: Additional Relevant Documents
The latest manuals can be downloaded from the HIMA website at www.hima.com. The revision
index on the footer can be used to compare the current version of existing manuals with the
Internet edition.
1.2 Target Audience
This document addresses system planners, configuration engineers, programmers of
automation devices and personnel authorized to implement, operate and maintain the modules
and systems. Specialized knowledge of safety-related automation systems is required.

F3 DIO 8/8 01 1 Introduction
HI 800 179 E Rev. 2.00 Page 7 of 52
1.3 Formatting Conventions
To ensure improved readability and comprehensibility, the following fonts are used in this
document:
Bold To highlight important parts.
Names of buttons, menu functions and tabs that can be clicked and used
in the programming tool.
Italics For parameters and system variables
Courier Literal user inputs
RUN Operating state are designated by capitals
Chapter 1.2.3 Cross references are hyperlinks even though they are not particularly
marked. When the cursor hovers over a hyperlink, it changes its shape.
Click the hyperlink to jump to the corresponding position.
Safety notes and operating tips are particularly marked.
1.3.1 Safety Notes
The safety notes are represented as described below.
These notes must absolutely be observed to reduce the risk to a minimum. The content is
structured as follows:
Signal word: warning, caution, notice
Type and source of risk
Consequences arising from non-observance
Risk prevention
The signal words have the following meanings:
Warning indicates hazardous situation which, if not avoided, could result in death or serious
injury.
Caution indicates hazardous situation which, if not avoided, could result in minor or modest
injury.
Notice indicates a hazardous situation which, if not avoided, could result in property damage.
NOTE
Type and source of damage!
Damage prevention
SIGNAL WORD
Type and source of risk!
Consequences arising from non-observance
Risk prevention

1 Introduction F3 DIO 8/8 01
Page 8 of 52 HI 800 179 E Rev. 2.00
1.3.2 Operating Tips
Additional information is structured as presented in the following example:
iThe text corresponding to the additional information is located here.
Useful tips and tricks appear as follows:
TIP The tip text is located here.

F3 DIO 8/8 01 2 Safety
HI 800 179 E Rev. 2.00 Page 9 of 52
2 Safety
All safety information, notes and instructions specified in this document must be strictly
observed. The product may only be used if all guidelines and safety instructions are adhered to.
This product is operated with SELV or PELV. No imminent risk results from the product itself.
The use in Ex-zone is permitted if additional measures are taken.
2.1 Intended Use
HIMatrix components are designed for assembling safety-related controller systems.
When using the components in the HIMatrix system, comply with the following general
requirements.
2.1.1 Environmental Requirements
Requirement type Range of values 1)
Protection class Protection class III in accordance with IEC/EN 61131-2
Ambient temperature 0...+60 °C
Storage temperature -40...+85 °C
Pollution Pollution degree II in accordance with IEC/EN 61131-2
Altitude < 2000 m
Housing Standard: IP20
Supply voltage 24 VDC
1) The values specified in the technical data apply and are decisive for devices with extended
environmental requirements.
Table 3: Environmental Requirements
Exposing the HIMatrix system to environmental conditions other than those specified in this
manual can cause the HIMatrix system to malfunction.
2.1.2 ESD Protective Measures
Only personnel with knowledge of ESD protective measures may modify or extend the system
or replace devices.
NOTE
Device damage due to electrostatic discharge!
When performing the work, make sure that the workspace is free of static, and wear
an ESD wrist strap.
If not used, ensure that the device is protected from electrostatic discharge, e.g., by
storing it in its packaging.

2 Safety F3 DIO 8/8 01
Page 10 of 52 HI 800 179 E Rev. 2.00
2.2 Residual Risk
No imminent risk results from a HIMatrix system itself.
Residual risk may result from:
Faults related to engineering
Faults related to the user program
Faults related to the wiring
2.3 Safety Precautions
Observe all local safety requirements and use the protective equipment required on site.
2.4 Emergency Information
A HIMatrix system is a part of the safety equipment of a site. If a device or a module fails, the
system enters the safe state.
In case of emergency, no action that may prevent the HIMatrix systems from operating safely is
permitted.

F3 DIO 8/8 01 3 Product Description
HI 800 179 E Rev. 2.00 Page 11 of 52
3 Product Description
The safety-related F3 DIO 8/8 01 remote I/O is a compact system in a metal housing with
8 digital inputs, 8 digital DO+ outputs (L- ground), 2 digital DO- outputs (S+ ground) and 2
pulsed outputs. The digital outputs DO4+, DO8+, DO4- and DO8- can also be connected as
2-pole connections.
The remote I/O is available in various model variants for SILworX and ELOP II Factory, see
Table 4.
Remote I/Os are connected to individual HIMax or HIMatrix controllers via safeethernet. They
are used to extend the I/O level, but are not able to run any user program by themselves.
The remote I/O is suitable for mounting in Ex-zone 2, see Chapter 4.1.5.
The device is TÜV-certified for safety-related applications up to SIL 3 (IEC 61508, IEC 61511
and IEC 62061), Cat. 4 and PL e (EN ISO 13849-1) and SIL 4 (EN 50126, EN 50128 and
EN 50129).
Further safety standards, application standards and test standards are specified in the
certificates available on the HIMA website.
3.1 Safety Function
The remote I/O is equipped with safety-related digital inputs and outputs. The input values on
the inputs are safely transmitted to the connected controller via safeethernet. The outputs are
safely assigned their values by the connected controller via safeethernet.
3.1.1 Safety-Related Digital Inputs
The remote I/O is equipped with 8 digital inputs. The state (HIGH, LOW) of each input is
signaled by an individual LED.
Mechanical contacts without own power supply or signal power source can be connected to the
inputs. Potential-free mechanical contacts without own power supply are fed via an internal
short-circuit-proof 24 V power source (LS+). Each of them supply a group of 4 mechanical
contacts. Figure 1 shows how the connection is performed.
With signal voltage sources, the corresponding ground must be connected to the input (L-), see
Figure 1.
DI 1
LS+
DI 4 DI 3 DI 2
DI 1
L-
DI 4 DI 3 DI 2
Connection of potential-free mechanical
contacts
Connection of signal power sources
Figure 1: Connections to Safety-Related Digital Inputs
For the external wiring and the connection of sensors, apply the de-energized-to-trip principle.
Thus, if a fault occurs, the input signals adopt a de-energized, safe state (low level).
If an external wire is not monitored, an open-circuit is considered as safe low level.

3 Product Description F3 DIO 8/8 01
Page 12 of 52 HI 800 179 E Rev. 2.00
3.1.1.1 Reaction in the Event of a Fault
If the device detects a fault on a digital input, the user program processes a low level in
accordance with the de-energized to trip principle.
The device activates the FAULT LED.
In addition to the channel signal value, the user program must also consider the corresponding
error code.
The error code allows the user to configure additional fault reactions in the user program.
3.1.1.2 Line Control
Line control is used to detect short-circuits or open-circuits and can be configured for the
remote I/O, e.g., on EMERGENCY STOP inputs complying with Cat. 4 and PL e in accordance
with EN ISO 13849-1.
To this end, connect the digital outputs TO 1 through TO 2 of the system to the digital inputs DI
of the same system as follows:
EMERGENCY STOP 1
EMERGENCY STOP 2
EMERGENCY STOP switches in
accordance with EN 60947-5-1 and
EN 60947-5-5
Figure 2: Line Control
The remote I/O pulses the pulsed outputs to detect short-circuits and open-circuits on the lines
connected to the digital inputs. To do so, configure the Value [BOOL] -> system variable in
SILworX or the DO[01].Value system signal in ELOP II Factory. The variables for the pulsed
outputs must begin with channel 1 and reside in direct sequence, one after the other.
If the following faults occur, the FAULT LED located on the front plate of the device blinks, the
inputs are set to low level and an (evaluable) error code is created:
Cross-circuit between two parallel wires.
Invalid connections of two lines (e.g., TO 2 to DI 3),
Earth fault on one wire (with earthed ground only).
Open-circuit or open contacts, i.e., including when one of the two EMERGENCY STOP
switches mentioned above has been engaged, the FAULT LED blinks and the error code is
created.

F3 DIO 8/8 01 3 Product Description
HI 800 179 E Rev. 2.00 Page 13 of 52
3.1.2 Safety-Related Digital Outputs
The remote I/O is equipped with 8 digital outputs DO+ (ground L-) and 2 digital outputs DO-
(ground S+). The state (HIGH, LOW) of each output is signaled by an individual LED (HIGH,
LOW).
At the maximum ambient temperature, the DO+ outputs 1...3 and 5...7 can be loaded with 0.5 A
each, and DO+ outputs 4 and 8 can be loaded with 1 A or with 2 A at an ambient temperature of
up to 40 °C.
At the maximum ambient temperature, the DO- outputs 4- and 8- can be loaded with 1 A each
or with 2 A at an ambient temperature of up to 40 °C.
Within a temperature range of 60…70 °C, all outputs of the F3 DIO 8/8 014 can be loaded with
0.5 A, see Table 15.
The digital outputs DO4+, DO8+, DO4- and DO8- can be connected as one-pole or 2-pole
switching connections. The remaining outputs are only set up for one-pole switching
connections.
With 1-pole switching outputs, ensure that the system's L- ground from the corresponding
channel group is used for the DO+ outputs and the system's S+ ground is used for the DO-
outputs, see Table 18. The S+ ground is limited by the system to a maximum current of 8 A and
obtained from the 24 V voltage connection.
The external wire of an output is not monitored, however, a detected short-circuit is signaled.
With 2-pole switching outputs, the L+ switching output DO4+ must be connected to the L-
switching output DO4- and the L+ switching output DO8+ to the L- switching output DO8-. This
type of connection must be set via the DO2[xx].2-pole system parameter.
S+
DO8- DO4-
DO4+
L- L-
DO8+
Figure 3: Connection to the 2-Pole Switching Outputs (DO-, DO+)

3 Product Description F3 DIO 8/8 01
Page 14 of 52 HI 800 179 E Rev. 2.00
3.1.2.1 Line Diagnosis
During 2-pole operation, a line diagnosis is performed to detect potential external short-circuits
to L+ and L-. Time on delay is required to detect external short-circuits with an inductive or
capacitive load or a lamp load. This delay can be configured using the Time on delay system
parameter. In the range of 0...30 ms, the value can be set in steps of 1 ms.
iInitial values must be set for all relevant system parameters of the line diagnosis
(DO2[xx].2-Pole, Time on delay).
Therefore, first set all required system parameters in the programming tool, then compile the
user program, and finally, transfer the program to the controller.
The settings for the system parameters configured for line diagnosis cannot be changed during
operation!
An external open-circuit will not be detected.
DO1
L-
DO2 DO3 DO4
L-
Figure 4: Connection of Actuators to Outputs
The redundant connection of two outputs must be decoupled with diodes. Only 1-pole switching
outputs may be connected redundantly.
CAUTION
For connecting a load to a one-pole switching output, use the corresponding L- ground
of the respective channel group (2-pole connection) to ensure that the internal protective
circuit can function.

F3 DIO 8/8 01 3 Product Description
HI 800 179 E Rev. 2.00 Page 15 of 52
3.1.2.2 Reaction in the Event of a Fault
If the device detects a faulty signal on a digital output, the affected module output is set to the
safe (de-energized) state using the safety switches.
If a device fault occurs, all digital outputs are switched off.
In both cases, the devices activates the FAULT LED.
The error code allows the user to configure additional fault reactions in the user program.
3.1.3 Pulsed Outputs
The 2 digital pulsed outputs can be used to detect short-circuits and open-circuits on digital
inputs, e.g., on EMERGENCY STOP button complying with Cat. 4 and PL e in accordance with
EN ISO 13849-1.
iPulsed outputs must not be used as safety-related outputs (e.g., for activating safety-related
actuators)!

3 Product Description F3 DIO 8/8 01
Page 16 of 52 HI 800 179 E Rev. 2.00
3.2 Equipment, Scope of Delivery
The following table specifies the available remote I/O variants:
Designation Description
F3 DIO 8/8 01 Remote I/O (8 digital inputs, 8 digital outputs, 2 pulsed outputs),
Operating temperature: 0...+60 °C,
for ELOP II Factory programming tool
F3 DIO 8/8 014 Remote I/O (8 digital inputs, 8 digital outputs, 2 pulsed outputs),
Operating temperature: -25...+70 °C (temperature class T1),
Vibration and shock tested according to EN 50125-3 and EN 50155,
class 1B according to IEC 61373,
for ELOP II Factory programming tool
F3 DIO 8/8 01
SILworX
Remote I/O (8 digital inputs, 8 digital outputs, 2 pulsed outputs),
Operating temperature: 0...+60 °C,
for SILworX programming tool
F3 DIO 8/8 014
SILworX
Remote I/O (8 digital inputs, 8 digital outputs, 2 pulsed outputs),
Operating temperature: -25...+70 °C (temperature class T1),
Vibration and shock tested according to EN 50125-3 and EN 50155,
class 1B according to IEC 61373,
for SILworX programming tool
Table 4: Available Variants
3.2.1 IP Address and System ID (SRS)
A transparent label is delivered with the device to allow one to note the IP address and the
system ID (SRS for system rack slot) after a change.
IP___.___.___.___SRS____.__.__
Default value for IP address: 192.168.0.99
Default value for SRS: 60 000.200.0 (SILworX)
60 000.0.0 (ELOP II Factory)
The label must be affixed such that the ventilation slots in the housing are not obstructed.
Refer to the First Steps manual of the programming tool for more information on how to modify
the IP address and the system ID.

F3 DIO 8/8 01 3 Product Description
HI 800 179 E Rev. 2.00 Page 17 of 52
3.3 Type Label
The type plate contains the following details:
Product name
Bar code (1D or 2D code)
Part no.
Production year
Hardware revision index (HW Rev.)
Firmware revision index (FW Rev.)
Operating voltage
Mark of conformity
Figure 5: Sample Type Label

3 Product Description F3 DIO 8/8 01
Page 18 of 52 HI 800 179 E Rev. 2.00
3.4 Assembly
This chapter describes the layout and function of the remote I/Os, and their communication via
safeethernet.
DIO
8/8 01
3
Figure 6: Front View
Digital Outputs (L+ Switching)
Safety-Related Processor System (CPU)
Switch
Watchdog
Digital Inputs
Digital Outputs (L- Switching)
Pulsed Outputs
Figure 7: Block Diagram

F3 DIO 8/8 01 3 Product Description
HI 800 179 E Rev. 2.00 Page 19 of 52
3.4.1 LED Indicators
The light-emitting diodes (LEDs) indicate the operating state of the remote I/O. The LEDs are
classified as follows:
Operating voltage LED
System LEDs
Communication LEDs
I/O LEDs
3.4.1.1 Operating Voltage LED
LED Color Status Description
On 24 VDC operating voltage present24 VDC Green
Off No operating voltage
Table 5: Operating Voltage LED
3.4.1.2 System LEDs
While the system is being booted, all LEDs are lit simultaneously.
LED Color Status Description
On Device in RUN, normal operation
Blinking Device in STOP
A new operating system is being loaded.
RUN Green
Off The device is not in the RUN state.
On The device is in the ERROR STOP state.
Internal fault detected by self-tests, e.g., hardware faults or cycle time
overrun.
The processor system can only be restarted with a command from the
PADT (reboot).
Blinking If ERROR blinks and all others LEDs are lit simultaneously, the boot
loader has detected an operating system fault in the flash memory and
waits for a new operating system to be loaded.
ERROR Red
Off No faults detected.
On A new configuration is being loaded into the device.
Blinking The device switches from INIT to STOP
A new operating system is being loaded into the flash ROM.
PROG Yellow
Off No configuration or operating system is being loaded.
FORCE Yellow Off The FORCE LED of a remote I/O is not functioning. The FORCE LED of
the associated controller serves to signal the forcing of a remote I/O.
On The loaded configuration is not valid.
The new operating system is corrupted (after OS download).
Blinking Fault while loading a new operating system
One or multiple I/O faults occurred.
FAULT Yellow
Off None of the described faults occurred.
Blinking Operating system emergency loader active.OSL Yellow
Off Operating system emergency loader inactive.
Blinking OS and OSL binary defective or hardware fault, INIT_FAIL.BL Yellow
Off None of the described faults occurred.
Table 6: System LEDs

3 Product Description F3 DIO 8/8 01
Page 20 of 52 HI 800 179 E Rev. 2.00
3.4.1.3 Communication LEDs
All RJ-45 connectors are provided with a small green and a yellow LEDs. The LEDs signal the
following states:
LED Status Description
On Full duplex operation
Blinking Collision
Green
Off Half duplex operation, no collision
On Connection available
Blinking Interface activity
Yellow
Off No connection available
Table 7: Ethernet Indicators
3.4.1.4 I/O LEDs
LED Color Status Description
On The related input is active (energized).DI 1…8 Yellow
Off The related input is inactive (de-energized).
On Pulsed output activated.
TO 1,
TO 2
Yellow
Off Pulsed output deactivated.
On The related output is active (energized).DO 1…8 Yellow
Off The related output is inactive (de-energized).
On The related output is active (energized).
DO 4-, DO
8-
Yellow
Off The related output is inactive (de-energized).
Table 8: I/O LEDs