HIMA HIMatrix F60 User manual

HIMatrix
Safety-Related Controller
System Manual Modular Systems
HIMA Paul Hildebrandt GmbH + Co KG
Industrial Automation
Rev. 2.02 HI 800 191 E

HI 800 191 E Rev. 2.02 (1336)
All HIMA products mentioned in this manual are protected by the HIMA trade-mark. Unless noted otherwise,
this also applies to other manufacturers and their respective products referred to herein.
All of the instructions and technical specifications in this manual have been written with great care and
effective quality assurance measures have been implemented to ensure their validity. For questions, please
contact HIMA directly. HIMA appreciates any suggestion on which information should be included in the
manual.
Equipment subject to change without notice. HIMA also reserves the right to modify the written material
without prior notice.
For further information, refer to the HIMA DVD and our website http://www.hima.de and
http://www.hima.com.
© Copyright 2013, HIMA Paul Hildebrandt GmbH + Co KG
All rights reserved
Contact
HIMA contact details:
HIMA Paul Hildebrandt GmbH + Co KG
P.O. Box 1261
68777 Brühl, Germany
Phone: [phone]
Fax: [phone]
E-mail: [email protected]
Revision
index
Revisions
Type of change
technical
editorial
1.00
The SILworX programming tool is taken into account
The document layout has been modified.
X
X
2.00
HIMatrix devices F*03, SILworX V4, HIMatrix CPU OS V8, COM
OS V13 are taken into account
X
X
2.01
SILworX V5, adaptations from the engineering manual - to replace
the engineering manual, parameters for remote I/Os, licensing are
handled
X
X
2.02
Added: Notes on redundant safeethernet, VLAN, CAN
X

System Manual Modular Systems Table of Contents
HI 800 191 E Rev. 2.02 Page 3 of 114
Table of Contents
1Introduction 9
1.1 Structure and Use of the Document 9
1.2 Target Audience 11
1.3 Formatting Conventions 11
1.3.1 Safety Notes 11
1.3.2 Operating Tips 12
1.4 Service and Training 12
2Safety 13
2.1 Intended Use 13
2.1.1 Scope 13
2.1.1.1 Application in Accordance with the De-Energize to Trip Principle 13
2.1.1.2 Application in Accordance with the Energize to Trip Principle 13
2.1.1.3 Use in Fire Alarm Systems 13
2.1.2 Non-Intended Use 13
2.2 Environmental Requirements 14
2.2.1 Test Conditions 14
2.2.1.1 Climatic Requirements 15
2.2.1.2 Mechanical Requirements 15
2.2.1.3 EMC Requirements 15
2.2.1.4 Power Supply 16
2.2.2 Noxious Gases 16
2.3 Tasks and Responsibilities of Operators and Machine and System Manufacturers
16
2.3.1 Connection of Communication Partners 16
2.3.2 Use of Safety-Related Communication 16
2.4 ESD Protective Measures 17
2.5 Residual Risk 17
2.6 Safety Precautions 17
2.7 Emergency Information 17
3Product Description 18
3.1 Modules 18
3.1.1 Inputs 18
3.1.2 Outputs 19
3.1.3 Line Control 19
3.2 Supply Voltage Monitoring 20
3.3 Monitoring the Temperature State 21
3.3.1 Setting the Temperature Threshold for Messages in F*03 Devices 21
3.4 Short-Circuit Reaction of Output Channels 22
3.5 Alarms and Sequences of Events Recording - with CPU 03 22
3.5.1 Alarms&Events 22
3.5.2 Creating Events 22
3.5.3 Recording Events 23
3.5.4 Transfer of Events 23
3.6 Product Data 23

Table of Contents System Manual Modular Systems
Page 4 of 114 HI 800 191 E Rev. 2.02
3.7 Licensing with CPU 03 23
4Communication 25
4.1 HIMatrix Communication Protocols 25
4.2 Ethernet Communication 25
4.2.1 safeethernet 25
4.2.2 Maximum Communication Time Slice 27
4.2.3 Connectors for safeethernet/Ethernet 27
4.2.4 Communication with the PADT 27
4.2.5 Ethernet Communication Protocols 28
4.2.5.1 SNTP 28
4.2.5.2 Modbus TCP 28
4.2.5.3 Send & Receive TCP 28
4.2.5.4 PROFINET IO and PROFIsafe (with F*03 only) 28
4.2.5.5 EtherNet/IP (up to CPU OS V7) 28
4.3 Fieldbus Communication 29
4.3.1 Equipment of Fieldbus Interfaces with Fieldbus Submodules 29
4.3.2 Restrictions for Operating Protocols Simultaneously 29
5Operating System 31
5.1 Functions of the Processor Operating System 31
5.2 Indication of the Operating System Versions 31
5.2.1 SILworX 31
5.2.2 ELOP II Factory 31
5.3 Behavior in the Event of Faults 31
5.3.1 Permanent Faults on Inputs or Outputs 32
5.3.2 Temporary Faults on Inputs or Outputs 32
5.3.3 Internal Faults 32
5.4 The Processor System 32
5.4.1 Modes of Operation for the Processor System 33
5.4.2 Programming 33
6User Program 34
6.1 Modes of Operation for the User Program 34
6.2 User Program Cycle Sequence, Multitasking with CPU 03 34
6.2.1 Multitasking 35
6.2.2 Multitasking Mode 37
6.3 Reload - with CPU 03 41
6.4 General Information 43
6.5 Forcing - CPU OS V7 and Higher 43
6.5.1 Forcing in Connection with F*03 44
6.5.2 Forcing in Connection with Standard Devices and Modules 44
6.5.3 Restriction to the Use of Forcing 46
6.6 Forcing - CPU OS up to V7 46
6.6.1 Time Limits 46
6.6.2 Configuration Parameters for Forcing 47
6.6.3 Force Allowed - CPU Switch 47
7Start-Up 48
7.1 Considerations about Heat 48

System Manual Modular Systems Table of Contents
HI 800 191 E Rev. 2.02 Page 5 of 114
7.1.1 Heat Dissipation 48
7.1.1.1 Definitions 48
7.1.1.2 Installation Type 48
7.1.1.3 Natural Convection 49
7.2 Installation and Mounting 49
7.2.1 Mounting 49
7.2.2 Construction Depth 50
7.2.3 Mounting on a Flat Base 51
7.2.4 Mounting and Removing the Modules 51
7.2.5 Connecting the Input and Output Circuits 51
7.2.6 Earthing and Shielding 52
7.2.6.1 Earthing the 24 VDC System Voltage 52
7.2.6.2 Earthing Connections 53
7.2.6.3 Shielding 53
7.2.6.4 EMC Protection 53
7.2.7 Connecting the Supply Voltage 53
7.2.8 Using the Reset Key with the CPU 01 and CPU 03 Modules 54
7.3 Configuration with SILworX - CPU OS V7 and Higher 54
7.3.1 Configuring the Resource 54
7.3.1.1 Resource Properties 55
7.3.1.2 Parameters for the Remote I/Os 58
7.3.1.3 Hardware System Variables for Setting the Parameters 58
7.3.1.4 Hardware System Variables for Reading the Parameters 59
7.3.1.5 Rack System Parameter Settings 62
7.3.2 Configuring the Ethernet Interfaces 62
7.3.3 Configuring the User Program 62
7.3.4 Configuring the Inputs and Outputs 63
7.3.5 Configure Line Control 65
7.3.5.1 Required Variables 65
7.3.5.2 Configuring Pulsed Outputs 66
7.3.5.3 Configuration Example with SILworX 67
7.3.6 Generating the Resource Configuration 68
7.3.7 Configuring the System ID and the Connection Parameters 68
7.3.8 Loading a Resource Configuration after a Reset 69
7.3.9 Loading a Resource Configuration from the PADT 69
7.3.10 Loading a Resource Configuration from the Flash Memory of the Communication
System 70
7.3.11 Cleaning up a Resource Configuration in the Flash Memory of the Communication
System 70
7.3.12 Setting the Date and the Time 70
7.4 User Management in SILworX - CPU OS V7 and Higher 71
7.4.1 User Management for SILworX Projects 71
7.4.2 User Management for the Controller 71
7.4.3 Setting up User Accounts 73
7.5 Configuration with SILworX - CPU OS V7 and Higher 74
7.5.1 Configuring the Ethernet Interfaces 74
7.6 Configuring Alarms and Events - with CPU 03 75
7.7 Configuring a Resource Using ELOP II Factory - CPU OS up to V7 78
7.7.1 Configuring the Resource 78
7.7.2 Configuring the User Program 79
7.7.3 Configuring the Inputs and Outputs 81

Table of Contents System Manual Modular Systems
Page 6 of 114 HI 800 191 E Rev. 2.02
7.7.4 Configure Line Control 82
7.7.4.1 Required Signals 82
7.7.4.2 Configuring Pulsed Outputs 83
7.7.4.3 Configuration Example with ELOP II Factory 83
7.7.5 Generating the Code for the Resource Configuration 84
7.7.6 Configuring the System ID and the Connection Parameters 85
7.7.7 Loading a Resource Configuration after a Reset 85
7.7.8 Loading a Resource Configuration from the PADT 86
7.7.9 Loading a Resource Configuration from the Flash Memory of the Communication
System 87
7.7.10 Deleting a Resource Configuration from the Flash Memory of the Communication
System 87
7.8 Configuring Communication with ELOP II Factory - up to CPU OS V7 88
7.8.1 Configuring the Ethernet Interfaces 88
7.8.2 System Signals of safeethernet Communication 90
7.8.3 Configuring the safeethernet Connection 92
7.8.4 Configuring the Signals for safeethernet Communication 93
7.9 Handling the User Program 95
7.9.1 Setting the Parameters and the Switches 95
7.9.2 Starting the Program from STOP/VALID CONFIGURATION 95
7.9.3 Restarting the Program after Errors 95
7.9.4 Stopping the Program 95
7.9.5 Program Test Mode 95
7.9.6 Online Test 96
8Operation 97
8.1 Handling 97
8.2 Diagnosis 97
8.2.1 Light-Emitting Diode Indicators 97
8.2.2 Diagnostic History 97
8.2.3 Diagnosis in SILworX- CPU OS V7 and Higher 99
8.2.4 Diagnosis in ELOP II Factory - up to CPU OS V7 99
9Maintenance 100
9.1 Interferences 100
9.2 Replacing Fans 100
9.3 Loading Operating Systems 100
9.3.1 Loading the Operating System with SILworX 101
9.3.2 Loading the Operating System with ELOP II Factory 101
9.3.3 Switching between ELOP II Factory and SILworX - not with F*03 101
9.3.3.1 Upgrading from ELOP II Factory to SILworX 102
9.3.3.2 Downgrading from SILworX to ELOP II Factory 102
9.4 Repair of Devices and Modules 102
10 Decommissioning 103
11 Transport 104
12 Disposal 105
Appendix 107
Glossary 107

System Manual Modular Systems Table of Contents
HI 800 191 E Rev. 2.02 Page 7 of 114
Index of Figures 108
Index of Tables 109
Declaration of Conformity 111
Index 112

Table of Contents System Manual Modular Systems
Page 8 of 114 HI 800 191 E Rev. 2.02

System Manual Modular Systems 1 Introduction
HI 800 191 E Rev. 2.02 Page 9 of 114
1 Introduction
The modular HIMatrix F60 system described in this manual is safety-related and can be used
for various purposes. The following conditions must be met to safely install and start up the
HIMatrix automation devices, and to ensure safety during their operation and maintenance:
Knowledge of regulations.
Proper technical implementation of the safety instructions detailed in this manual performed
by qualified personnel.
HIMA will not be held liable for severe personal injuries, damage to property or the surroundings
caused by any of the following: unqualified personnel working on or with the devices, de-
activation or bypassing of safety functions, or failure to comply with the instructions detailed in
this manual (resulting in faults or impaired safety functionality).
HIMatrix automation devices have been developed, manufactured and tested in compliance with
the pertinent safety standards and regulations. They may only be used for the intended
applications under the specified environmental conditions and only in connection with approved
external devices.
1.1 Structure and Use of the Document
This system manual is composed of the following chapters:
Safety
Information on how to safely use the HIMatrix system.
Allowed applications and environmental requirements for operating
the HIMatrix systems.
Product Description
Basic structure of the HIMatrix system.
Communication
Brief description of the HIMatrix modular systems' communication
among each other and with other systems. Detailed information can
be found in the communication manuals.
Operating system
Functions of the operating systems.
User Program
Basic information on the user program.
Start-up, operation,
maintenance, placing
out of operation,
transport, disposal
Phases of a HIMatrix system's lifecycle.
Appendix
Glossary
Index of tables and index of figures
Declaration of Conformity
Index
i
This document usually refers to compact controllers and remote I/Os as devices, and to the
plug-in cards of a modular controller as modules.
Modules is also the term used in SILworX.
The following HIMatrix devices have additional functions:
F60 CPU 03
F35 03
F31 03
F30 03
F10 PCI 03

1 Introduction System Manual Modular Systems
Page 10 of 114 HI 800 191 E Rev. 2.02
All these devices are identified in this document with F*03. The additional features of these
devices compared to standard devices are:
Enhanced performance
Sequence of events recording possible
Multitasking possible
Reload possible
Two IP addresses
This manual distinguishes between the following variants of the HIMatrix system:
Programming tool
Hardware
Processor operating
system
Communication
operating system
SILworX
F*03
CPU OS V8 and higher
COM OS V13 and
higher
SILworX
Default
CPU OS V7 and higher
COM OS V12 and
higher
ELOP II Factory
Default
CPU OS up to V7
COM OS up to V12
Table 1: HIMatrix System Variants
The manual distinguishes among the different variants using:
Separated chapters
Tables differentiating among the versions, e.g., CPU OS V7 and higher, or CPU OS up to V7
i
Projects created with ELOP II Factory cannot be edited with SILworX, and vice versa!
Additionally, the following documents must be taken into account:
Name
Content
Document
number
HIMatrix Safety Manual
Safety functions of the HIMatrix system
HI 800 023 E
SILworX Communication
Manual
Description of the communication protocols, ComUserTask
and their configuration in SILworX
HI 801 101 E
HIMatrix PROFIBUS DP
Master/Slave Manual
Description of the PROFIBUS protocol and its configuration
in ELOP II Factory
HI 800 009 E
HIMatrix Modbus
Master/Slave Manual
Description of the Modbus protocol and its configuration in
ELOP II Factory
HI 800 003 E
HIMatrix
TCP S/R Manual
Description of the TCP S/R protocol and its configuration in
ELOP II Factory
HI 800 117 E
HIMatrix ComUserTask (CUT)
Manual
Description of the ComUserTask and its configuration in
ELOP II Factory
HI 800 329 E
SILworX Online Help
Instructions on how to use SILworX
-
ELOP II Factory Online Help
Instructions on how to use ELOP II Factory, Ethernet IP
protocol
-
SILworX First Steps
Introduction to SILworX
HI 801 103 E
ELOP II Factory First Steps
Introduction to ELOP II Factory
HI 800 006 E
Table 2: Additional Relevant Documents
The latest manuals can be downloaded from the HIMA website at www.hima.com. The revision
index on the footer can be used to compare the current version of existing manuals with the
Internet edition.

System Manual Modular Systems 1 Introduction
HI 800 191 E Rev. 2.02 Page 11 of 114
In addition to the Table 2 documents, the manuals specific to the F60 modules in use must be
taken into account.
1.2 Target Audience
This document addresses system planners, configuration engineers, programmers of
automation devices and personnel authorized to implement, operate and maintain the modules
and systems. Specialized knowledge of safety-related automation systems is required.
1.3 Formatting Conventions
To ensure improved readability and comprehensibility, the following fonts are used in this
document:
Bold
To highlight important parts.
Names of buttons, menu functions and tabs that can be clicked and used
in the programming tool.
Italics
For parameters and system variables
Courier
Literal user inputs
RUN
Operating state are designated by capitals
Chapter 1.2.3
Cross-references are hyperlinks even if they are not particularly marked.
When the cursor hovers over a hyperlink, it changes its shape. Click the
hyperlink to jump to the corresponding position.
Safety notes and operating tips are particularly marked.
1.3.1 Safety Notes
The safety notes are represented as described below.
These notes must absolutely be observed to reduce the risk to a minimum. The content is
structured as follows:
Signal word: warning, caution, notice
Type and source of risk
Consequences arising from non-observance
Risk prevention
The signal words have the following meanings:
Warning indicates hazardous situation which, if not avoided, could result in death or serious
injury.
Caution indicates hazardous situation which, if not avoided, could result in minor or modest
injury.
Notice indicates a hazardous situation which, if not avoided, could result in property damage.
SIGNAL WORD
Type and source of risk!
Consequences arising from non-observance
Risk prevention

1 Introduction System Manual Modular Systems
Page 12 of 114 HI 800 191 E Rev. 2.02
NOTE
Type and source of damage!
Damage prevention
1.3.2 Operating Tips
Additional information is structured as presented in the following example:
i
The text corresponding to the additional information is located here.
Useful tips and tricks appear as follows:
TIP
The tip text is located here.
1.4 Service and Training
Deadlines and the extent of actions for commissioning, testing and modifying controller systems
can be agreed with the service department.
HIMA holds training, usually in-house, for software programs and the hardware of the
controllers. Additionally, customer training can be offered on-site.
Refer to the HIMA website at www.hima.com for the current training program and dates. Offers
for specialized, on-site training can also be provided upon request.

System Manual Modular Systems 2 Safety
HI 800 191 E Rev. 2.02 Page 13 of 114
2 Safety
All safety information, notes and instructions specified in this document must be strictly
observed. The product may only be used if all guidelines and safety instructions are adhered to.
The product is operated with SELV or PELV. No imminent risk results from the product itself.
The use in Ex-Zone is permitted if additional measures are taken.
2.1 Intended Use
This chapter describes the conditions for using HIMatrix systems.
2.1.1 Scope
The safety-related HIMatrix controllers can be used in applications up to SIL 3 in accordance
with IEC 61508.
The HIMatrix systems are certified for use in process controllers, protective systems, burner
controllers, and machine controllers.
2.1.1.1 Application in Accordance with the De-Energize to Trip Principle
The automation devices have been designed in accordance with the de-energize to trip
principle.
A system that operates in accordance with the de-energize to trip principle adopts the de-
energized state if a fault occurs.
2.1.1.2 Application in Accordance with the Energize to Trip Principle
The HIMatrix controllers can be used in applications that operate in accordance with the
'energize to trip' principle.
A system operating in accordance with the energize to trip principle switches on, for instance,
an actuator to perform its safety function.
When designing the controller system, the requirements specified in the application standards
must be taken into account. For instance, line diagnosis for the inputs and outputs or message
reporting a triggered safety function may be required.
2.1.1.3 Use in Fire Alarm Systems
The HIMatrix systems with detection of short-circuits and open-circuits are tested and certified
for used in fire alarm systems in accordance with DIN EN 54-2 and NFPA 72. To contain the
risks, these systems must be able to adopt an active state on demand.
The operating requirements must be observed!
2.1.2 Non-Intended Use
The transfer of safety-relevant data through public networks like the Internet is permitted
provided that additional security measures such as VPN tunnel or firewall have been
implemented to increase security.

2 Safety System Manual Modular Systems
Page 14 of 114 HI 800 191 E Rev. 2.02
2.2 Environmental Requirements
Requirement type
Range of values 1)
Protection class
Protection class III in accordance with IEC/EN 61131-2
Ambient temperature
0...+60 °C
Storage temperature
-40...+85 °C
Pollution
Pollution degree II in accordance with IEC/EN 61131-2
Altitude
< 2000 m
Housing
Standard: IP20
Supply voltage
24 VDC
1) The values specified in the technical data apply and are essential for devices with extended
environmental requirements.
Table 3: Environmental Requirements
All the environmental requirements specified in this manual must be observed when operating
the HIMatrix system.
2.2.1 Test Conditions
The devices have been tested to ensure compliance with the following standards for EMC,
climatic and environmental requirements:
Standard
Content
IEC/EN 61131-2:
2007
Programmable controllers, Part 2
Equipment requirements and tests
IEC/EN 61000-6-2:
2005
EMC
Generic standards, Parts 6-2
Immunity for industrial environments
IEC/EN 61000-6-4:
2007 + A1:2011
Electromagnetic Compatibility (EMC)
Generic emission standard, industrial environments
Table 4: Standards for EMC, Climatic and Environmental Requirements
When using the safety-related HIMatrix control systems, the following general requirements
must be met:
Requirement type
Requirement content
Protection class
Protection class III in accordance with IEC/EN 61131-2
Pollution
Pollution degree II in accordance with IEC/EN 61131-2
Altitude
< 2000 m
Housing
Standard: IP20
If required by the relevant application standards (e.g., EN 60204,
EN 13849), the HIMatrix system must be installed in an enclosure of the
specified protection class (e.g., IP54).
Table 5: General Requirements

System Manual Modular Systems 2 Safety
HI 800 191 E Rev. 2.02 Page 15 of 114
2.2.1.1 Climatic Requirements
The following table lists the most important tests and limits for climatic requirements:
IEC/EN 61131-2
Climatic tests
Operating temperature: 0...+60 °C
(test limits: -10...+70 °C)
Storage temperature: -40...+85 °C
Dry heat and cold resistance tests:
+70 °C / -25 °C, 96 h,
power supply not connected
Temperature change, resistance and immunity test:
-40 °C / +70 °C und 0 °C / +55 °C,
power supply not connected
Cyclic damp-heat withstand tests:
+25 °C / +55 °C, 95 % relative humidity,
power supply not connected
Table 6: Climatic Requirements
Operating requirements other than those specified in this document are described in the device-
specific or module-specific manuals.
2.2.1.2 Mechanical Requirements
The following table lists the most important tests and limits for mechanical requirements:
IEC/EN 61131-2
Mechanical tests
Vibration immunity test:
5...9 Hz / 3.5 mm
9...150 Hz, 1 g, EUT in operation, 10 cycles per axis
Shock immunity test:
15 g, 11 ms, EUT in operation, 3 shocks per axis (18 shocks)
Table 7: Mechanical Tests
2.2.1.3 EMC Requirements
Higher interference levels are required for safety-related systems. HIMatrix systems meet these
requirements in accordance with IEC 62061 and IEC 61326-3-1. See column Criterion FS
(Functional Safety).
IEC/EN 61131-2
Interference immunity tests
Criterion FS
IEC/EN 61000-4-2
ESD test: 6 kV contact, 8 kV air discharge
6 kV, 8 kV
IEC/EN 61000-4-3
RFI test (10 V/m): 80 MHz...2 GHz, 80 % AM
RFI test (3 V/m): 2 GHz...3 GHz, 80 % AM:
RFI test (20 V/m): 80 MHz...1 GHz, 80 % AM
-
-
20 V/m
IEC/EN 61000-4-4
Burst test
Power lines: 2 kV and 4 kV
Signal lines: 2 kV
4 kV
2 kV
IEC/EN 61000-4-12
Damped oscillatory wave test
2.5 kV L-, L+ / PE
1 kV L+ / L-
-
-
IEC/EN 61000-4-6
High frequency, asymmetrical
10 V, 150 kHz...80 MHz, AM
20 V, ISM frequencies, 80 % AM
10 V
-
IEC/EN 61000-4-3
900 MHz pulses
-
IEC/EN 61000-4-5
Surge:
Power lines: 2 kV CM, 1 kV DM
Signal lines: 2 kV CM, 1 kV DM at AC I/O
2 kV /1 kV
2 kV
Table 8: Interference Immunity Tests

2 Safety System Manual Modular Systems
Page 16 of 114 HI 800 191 E Rev. 2.02
IEC/EN 61000-6-4
Noise emission tests
EN 55011
Class A
Emission test:
radiated, conducted
Table 9: Noise Emission Tests
2.2.1.4 Power Supply
The following table lists the most important tests and limits for the HIMatrix systems' power
supply:
IEC/EN 61131-2
Verification of the DC supply characteristics
The power supply must comply with the following standards:
IEC/EN 61131-2:
SELV (Safety Extra Low Voltage) or
PELV (Protective Extra Low Voltage)
HIMatrix systems must be fuse protected as specified in this manual
Voltage range test:
24 VDC, -20...+25 % (19.2...30.0 V)
Momentary external current interruption immunity test:
DC, PS 2: 10 ms
Reversal of DC power supply polarity test:
Refer to corresponding chapter of the system manual or data sheet of
power supply.
Table 10: Verification of the DC Supply Characteristics
2.2.2 Noxious Gases
HIMatrix components may be operated without functional and safety restrictions in
environments with noxious gas concentrations as described in the following standards:
ANSI/ISA -S71.04:1985
Corrosive gases, Class G3
DIN EN 60068-2-60: 1996 (also IEC 68-2-60: 1995)
With noxious gas concentrations higher than those mentioned in the standards, a reduced
component lifetime is to be expected. The user is responsible for demonstrating that the
environment is sufficiently free from noxious gases.
2.3 Tasks and Responsibilities of Operators and Machine and System
Manufacturers
Operators and machine and system manufacturers are responsible for ensuring that HIMatrix
systems are safely operated in automated systems and plants.
Machine and system manufacturers must sufficiently validate that the HIMatrix systems were
properly programmed.
2.3.1 Connection of Communication Partners
Only devices with safe electrical separation may be connected to the communications
interfaces.
2.3.2 Use of Safety-Related Communication
When implementing safety-related communications between various devices, ensure that the
overall response time does not exceed the fault tolerance time. All calculations must be
performed in accordance with the rules given in this chapter.

System Manual Modular Systems 2 Safety
HI 800 191 E Rev. 2.02 Page 17 of 114
2.4 ESD Protective Measures
Only personnel with knowledge of ESD protective measures may modify or extend the system
or replace a module.
NOTE
Electrostatic discharge can damage the electronic components within the HIMatrix
systems!
When performing the work, make sure that the workspace is free of static, and wear
an ESD wrist strap.
If not used, ensure that the modules are protected from electrostatic discharge, e.g.,
by storing them in their packaging.
2.5 Residual Risk
No imminent risk results from a modular HIMatrix F60 system itself.
Residual risk may result from:
Faults related to engineering
Faults related to the user program
Faults related to the wiring
2.6 Safety Precautions
Observe all local safety requirements and use the protective equipment required on site.
2.7 Emergency Information
A HIMatrix system is a part of the safety equipment of a plant. If a device or a module fails, the
system enters the safe state.
In case of emergency, no action that may prevent the HIMatrix systems from operating safely is
permitted.

3 Product Description System Manual Modular Systems
Page 18 of 114 HI 800 191 E Rev. 2.02
3 Product Description
The modular HIMatrix F60 system is composed of a subrack and various modules inserted in
the subrack slots.
Slots 1 and 2 are reserved, all remaining slots can be freely occupied:
The wide slot 1 is always occupied with the power supply module (PS 01).
Slot 2 is always occupied with the CPU module (CPU 01).
The remaining slots can be freely occupied with all remaining module types.
The modular system F60 can also be connected to HIMatrix compact systems via safeethernet.
3.1 Modules
All modules of the HIMatrix F60 system are 6 rack units (RU) high, which correspond to
262 mm.
Specific slots are only reserved for the power supply module and the CPU module, see above.
NOTE
Controller damage!
Inserting and removing the modules during operation is not permitted.
Prior to modifying the assembly, ensure that the controller is shut down!
After modifying a controller assembly, the corresponding user program must be adapted to the
change and reloaded.
Pluggable clamps located on the module's front plate are used to connect sensors and
actuators. The modules indicate the status of digital signals via LEDs located next to the
clamps.
3.1.1 Inputs
The module's input channels are used to transmit and adjust the signals between the sensors
and the microprocessor systems on the CPU module.
The controller continuously tests the safety-related modules. Depending on the fault, it switches
either only the affected channel off or the entire module, in which case the module is indicated
as faulty. The controller's operating system then sets the system user program's input value to
the safe value 0 (or the initial value).
Signal sources with their own voltage may also be connected instead of contacts. To this end,
the signal source ground must be connected to the input ground.
Surges on Digital Inputs
Due to the short cycle time of the HIMatrix systems, a surge pulse as described in EN 61000-4-
5 can be read in to the digital inputs as a short-term high level.
To prevent malfunctions, take one of the following measures for the application:
Install shielded input wires to prevent surges within the system.
Activate noise blanking: a signal must be present for at least two cycles before it is
evaluated.
Caution: This action increases the system's response time!

System Manual Modular Systems 3 Product Description
HI 800 191 E Rev. 2.02 Page 19 of 114
i
The measures specified above are not necessary if the plant design precludes surges from
occurring within the system.
In particular, the design must include protective measures with respect to overvoltage,
lightning, earth grounding and plant wiring in accordance with the relevant standards and the
manufacturer's specifications.
3.1.2 Outputs
The module's output channels are used to transmit and adjust the signals between the
microprocessor systems on the central module and the actuators.
The controller continuously tests the modules. Depending on the fault, it switches either only the
affected channel off or the entire module, in which case the module is indicated as faulty. The
outputs are set to the safe de-energized state.
NOTE
Controller damage!
Do not plug the terminals for output circuits if a load is connected.
If short-circuits are present, the resulting high current may damage the terminals.
Inductive loads may be connected with no free-wheeling diode on the actuator. However, HIMA
recommends connecting a protective diode directly to the actuator.
3.1.3 Line Control
Line control is used to detect short-circuits or open-circuits and can be configured for the
HIMatrix systems, e.g., on EMERGENCY STOP inputs complying with Cat. 4 and PL e in
accordance with EN ISO 13849-1.
To this end, connect the digital outputs DO of the system to the digital inputs (DI) of the same
system as follows:
DO [1]
1
DI [5]
DO [3]
DI [7]
T1
S1_1
2
[2]
[6] [8]
[4]
T2
S1_2 S2_1 S2_2
T4T3
EMERGENCY STOP 1
EMERGENCY STOP 2
EMERGENCY STOP devices in accordance
with EN 60947-5-1 and EN 60947-5-5
Figure 1: Line Control

3 Product Description System Manual Modular Systems
Page 20 of 114 HI 800 191 E Rev. 2.02
T 1
T 2
1
1
Configurable 5...2000 µs
Figure 2: Pulsed Signals T1 and T2
The digital outputs DO are pulsed (briefly set to low level), to monitor the wires connected to the
digital inputs. The time base of the test pulse can be configured within 5...2000 μs (default value
400 μs).
i
If line control is configured in a remote I/O, the remote I/O's watchdog time must be increased
(default value 10 ms).
Line control detects the following faults:
Cross-circuit between two parallel wires.
Improper connection of two wires DO to DI, connection in contrast with the configuration
specified in the software, e.g., DO 2 → DI 7 (configured), DO 2 → DI 6 (wired).
Earth fault on one wire (with earthed ground only).
Open-circuit or open contacts, i.e., including when one of the two EMERGENCY STOP
switches mentioned above has been engaged, the FAULT LED blinks and the error code is
created.
If such a fault occurs, the following reactions are triggered:
The FAULT LED on the module's or device's front plate blinks.
The inputs are set to low level.
An (evaluable) error code is created.
If multiple faults occur simultaneously, the error code is the sum of all single fault error codes.
3.2 Supply Voltage Monitoring
The HIMatrix system is a single voltage system. In accordance with IEC/EN 61131-2, the
required supply voltage is defined as follows:
Supply voltage
Nominal value
24 VDC, -15...+20 %
20.4...28.8 V
Max. permissible function limits in
continuous operation
18.5...30.2 V
(including ripple)
Maximum peak value
35 V for 0.1 s
Permissible ripple
r < 5 % as r.m.s. value
rPP < 15 % as value peak-to-peak
Ground
L- (negative pole)
Earthing the ground is permitted, see Chapter
7.2.6.1.
Table 11: Supply Voltage