HIMA HIMatrix User manual

HIMatrix
Safety-Related Controller
F3 DIO 16/8 01 Manual
HIMA Paul Hildebrandt GmbH + Co KG
Industrial Automation
Rev. 2.00 HI 800 177 E

HI 800 177 E Rev. 2.00 (1334)
All HIMA products mentioned in this manual are protected by the HIMA trade-mark. Unless noted otherwise,
this also applies to other manufacturers and their respective products referred to herein.
HIMax®, HIMatrix®, SILworX®, XMR®and FlexSILon®are registered trademarks of HIMA Paul Hildebrandt
GmbH + Co KG.
All of the instructions and technical specifications in this manual have been written with great care and
effective quality assurance measures have been implemented to ensure their validity. For questions, please
contact HIMA directly. HIMA appreciates any suggestion on which information should be included in the
manual.
Equipment subject to change without notice. HIMA also reserves the right to modify the written material
without prior notice.
For further information, refer to the HIMA DVD and our website at http://www.hima.de and
http://www.hima.com.
© Copyright 2013, HIMA Paul Hildebrandt GmbH + Co KG
All rights reserved
Contact
HIMA contact details:
HIMA Paul Hildebrandt GmbH + Co KG
P.O. Box 1261
68777 Brühl, Germany
Phone: [phone]
Fax: [phone]
E-mail: [email protected]
Type of change
Revision
index
Revisions
technical editorial
1.00 Added: Configuration with SILworX X X
1.01 Deleted: Chapter Monitoring the Temperature State integrated in
the system manual
X
2.00 Revised: Chapters 3.4.1, 3.4.2.1, 4.5 and 4.6.4
Added: F3 DIO 16/8 014, SIL 4 certified according to EN 50126,
EN 50128 and EN 50129, Chapter 4.1.5
X X

F3 DIO 16/8 01 Table of Contents
HI 800 177 E Rev. 2.00 Page 3 of 60
Table of Contents
1Introduction 7
1.1 Structure and Use of this Manual 7
1.2 Target Audience 8
1.3 Formatting Conventions 9
1.3.1 Safety Notes 9
1.3.2 Operating Tips 10
2Safety 11
2.1 Intended Use 11
2.1.1 Environmental Requirements 11
2.1.2 ESD Protective Measures 11
2.2 Residual Risk 12
2.3 Safety Precautions 12
2.4 Emergency Information 12
3Product Description 13
3.1 Safety Function 13
3.1.1 Safety-Related Digital Inputs 13
3.1.1.1 Reaction in the Event of a Fault 15
3.1.2 Line Control 15
3.1.3 Safety-Related Digital Outputs 16
3.1.3.1 Reaction in the Event of a Fault 16
3.1.4 Line Diagnosis with Digital Outputs 17
3.1.4.1 Line Diagnosis for Lamp Loads and Inductive Loads 17
3.1.4.2 Line Diagnosis for Ohmic, Capacitive Loads 18
3.1.4.3 Test Period and Monitoring Time 18
3.2 Equipment, Scope of Delivery 19
3.2.1 IP Address and System ID (SRS) 19
3.3 Type Label 20
3.4 Structure 21
3.4.1 LED Indicators 22
3.4.1.1 Operating Voltage LED 22
3.4.1.2 System LEDs 22
3.4.1.3 Communication LEDs 23
3.4.1.4 I/O LEDs 23
3.4.2 Communication 24
3.4.2.1 Connections for Ethernet Communication 24
3.4.2.2 Network Ports Used for Ethernet Communication 24
3.4.3 Pulsed Outputs 25
3.4.4 Reset Key 25
3.4.4.1 Ampacity of the Digital Outputs 25
3.5 Product Data 26
3.5.1 Product Data F3 DIO 16/8 014 27
3.6 Certified HIMatrix F3 DIO 16/8 01 28

Table of Contents F3 DIO 16/8 01
Page 4 of 60 HI 800 177 E Rev. 2.00
4Start-up 29
4.1 Installation and Mounting 29
4.1.1 Installation and Terminals of the Digital Inputs 29
4.1.2 Surges on Digital Inputs 30
4.1.3 Installation and Terminals of the Digital Inputs 30
4.1.3.1 Overview of Configuration Variants for the Digital Outputs 31
4.1.4 Pulsed Outputs 31
4.1.5 Cable Plugs 32
4.1.6 Mounting the F3 DIO 16/8 01 in Zone 2 33
4.2 Configuration 34
4.3 Configuration with SILworX 34
4.3.1 Parameters and Error Codes for the Inputs and Outputs 34
4.3.2 Digital Inputs of F3 DIO 16/8 01 34
4.3.2.1 Tab: Module 35
4.3.2.2 Tab: DI 16 LC: Channels 36
4.3.3 Digital Outputs of F3 DIO 16/8 01 37
4.3.3.1 Tab: Module 37
4.3.3.2 Tab: DO 8 03: Channels 39
4.3.4 Pulsed Outputs for F3 DIO 16/8 01 40
4.3.4.1 Tab: Module 40
4.3.4.2 Tab: DO 2 01: Channels 40
4.4 Configuration with ELOP II Factory 41
4.4.1 Configuring the Inputs and Outputs 41
4.4.2 Signals and Error Codes for the Inputs and Outputs 41
4.4.3 Digital Inputs of F3 DIO 16/8 01 42
4.4.4 Digital Outputs of F3 DIO 16/8 01 43
4.4.5 Pulsed Outputs for F3 DIO 16/8 01 45
4.5 Configuration of Line Diagnosis 46
4.5.1 Line Diagnosis for Lamp Loads and Inductive Loads 46
4.5.2 Line Diagnosis for Ohmic, Capacitive Loads 46
4.6 Connection Variants 47
4.6.1 1-Pole Connection 47
4.6.2 2-Pole Connection 48
4.6.3 2-Pole Connection to Common Ground (3-pole Connection) 49
5Operation 50
5.1 Handling 50
5.2 Diagnosis 50
5.2.1 Diagnostic Entries 50
6Maintenance 51
6.1 Faults 51
6.2 Maintenance Measures 51
6.2.1 Loading the Operating System 51
6.2.2 Proof Test 51

F3 DIO 16/8 01 Table of Contents
HI 800 177 E Rev. 2.00 Page 5 of 60
7Decommissioning 52
8Transport 53
9Disposal 54
Appendix 55
Glossary 55
Index of Figures 56
Index of Tables 57
Index 58

Table of Contents F3 DIO 16/8 01
Page 6 of 60 HI 800 177 E Rev. 2.00

F3 DIO 16/8 01 1 Introduction
HI 800 177 E Rev. 2.00 Page 7 of 60
1 Introduction
This manual describes the technical characteristics of the device and its use. It provides
information on how to install, start up and configure the module.
1.1 Structure and Use of this Manual
The content of this manual is part of the hardware description of the HIMatrix programmable
electronic system.
This manual is organized in the following main chapters:
Introduction
Safety
Product Description
Start-up
Operation
Maintenance
Decommissioning
Transport
Disposal
HIMatrix remote I/Os are available for the programming tools SILworX and ELOP II Factory.
Which programming tool can be used, depends on the processor operating system of the
HIMatrix remote I/O, refer to the following table:
Programming tool Processor operating system
SILworX CPU OS V7 and higher
ELOP II Factory CPU OS up to V6.x
Table 1: Programming Tools for HIMatrix Remote I/Os
In the manual, the differences are specified by using:
Separated chapters,
Tables differentiating among the versions
iProjects created with ELOP II Factory cannot be edited with SILworX, and vice versa!
iCompact controllers and remote I/Os are referred to as devices.

1 Introduction F3 DIO 16/8 01
Page 8 of 60 HI 800 177 E Rev. 2.00
Additionally, the following documents must be taken into account:
Name Content Document number
HIMatrix System Manual
Compact Systems
Hardware description of the HIMatrix
compact systems
HI 800 141 E
HIMatrix System Manual
Modular System F60
Hardware description of the HIMatrix
modular system
HI 800 191 E
HIMatrix Safety Manual Safety functions of the HIMatrix system HI 800 023 E
HIMatrix Safety Manual for
Railway Applications
Safety functions of the HIMatrix system
using the HIMatrix in railway
applications
HI 800 437 E
SILworX Online Help Instructions on how to use SILworX -
ELOP II Factory
Online Help
Instructions on how to use ELOP II
Factory, Ethernet IP protocol
-
SILworX First Steps Introduction to SILworX using the
HIMax system as an example
HI 801 103 E
ELOP II Factory First Steps Introduction to ELOP II Factory HI 800 006 E
Table 2: Additional Relevant Documents
The latest manuals can be downloaded from the HIMA website at www.hima.com. The revision
index on the footer can be used to compare the current version of existing manuals with the
Internet edition.
1.2 Target Audience
This document addresses system planners, configuration engineers, programmers of
automation devices and personnel authorized to implement, operate and maintain the modules
and systems. Specialized knowledge of safety-related automation systems is required.

F3 DIO 16/8 01 1 Introduction
HI 800 177 E Rev. 2.00 Page 9 of 60
1.3 Formatting Conventions
To ensure improved readability and comprehensibility, the following fonts are used in this
document:
Bold To highlight important parts.
Names of buttons, menu functions and tabs that can be clicked and used
in the programming tool.
Italics For parameters and system variables
Courier Literal user inputs
RUN Operating state are designated by capitals
Chapter 1.2.3 Cross references are hyperlinks even though they are not particularly
marked. When the cursor hovers over a hyperlink, it changes its shape.
Click the hyperlink to jump to the corresponding position.
Safety notes and operating tips are particularly marked.
1.3.1 Safety Notes
The safety notes are represented as described below.
These notes must absolutely be observed to reduce the risk to a minimum. The content is
structured as follows:
Signal word: warning, caution, notice
Type and source of risk
Consequences arising from non-observance
Risk prevention
The signal words have the following meanings:
Warning indicates hazardous situation which, if not avoided, could result in death or serious
injury.
Caution indicates hazardous situation which, if not avoided, could result in minor or modest
injury.
Notice indicates a hazardous situation which, if not avoided, could result in property damage.
NOTE
Type and source of damage!
Damage prevention
SIGNAL WORD
Type and source of risk!
Consequences arising from non-observance
Risk prevention

1 Introduction F3 DIO 16/8 01
Page 10 of 60 HI 800 177 E Rev. 2.00
1.3.2 Operating Tips
Additional information is structured as presented in the following example:
iThe text corresponding to the additional information is located here.
Useful tips and tricks appear as follows:
TIP The tip text is located here.

F3 DIO 16/8 01 2 Safety
HI 800 177 E Rev. 2.00 Page 11 of 60
2 Safety
All safety information, notes and instructions specified in this document must be strictly
observed. The product may only be used if all guidelines and safety instructions are adhered to.
This product is operated with SELV or PELV. No imminent risk results from the product itself.
The use in Ex-Zone is permitted if additional measures are taken.
2.1 Intended Use
HIMatrix components are designed for assembling safety-related controller systems.
When using the components in the HIMatrix system, comply with the following general
requirements.
2.1.1 Environmental Requirements
Requirement type Range of values 1)
Protection class Protection class III in accordance with IEC/EN 61131-2
Ambient temperature 0...+60 °C
Storage temperature -40...+85 °C
Pollution Pollution degree II in accordance with IEC/EN 61131-2
Altitude < 2000 m
Housing Standard: IP20
Supply voltage 24 VDC
1) The values specified in the technical data apply and are decisive for devices with extended
environmental requirements.
Table 3: Environmental Requirements
Exposing the HIMatrix system to environmental conditions other than those specified in this
manual can cause the HIMatrix system to malfunction.
2.1.2 ESD Protective Measures
Only personnel with knowledge of ESD protective measures may modify or extend the system
or replace devices.
NOTE
Device damage due to electrostatic discharge!
When performing the work, make sure that the workspace is free of static, and wear
an ESD wrist strap.
If not used, ensure that the device is protected from electrostatic discharge, e.g., by
storing it in its packaging.

2 Safety F3 DIO 16/8 01
Page 12 of 60 HI 800 177 E Rev. 2.00
2.2 Residual Risk
No imminent risk results from a HIMatrix system itself.
Residual risk may result from:
Faults related to engineering
Faults related to the user program
Faults related to the wiring
2.3 Safety Precautions
Observe all local safety requirements and use the protective equipment required on site.
2.4 Emergency Information
A HIMatrix system is a part of the safety equipment of a site. If a device or a module fails, the
system enters the safe state.
In case of emergency, no action that may prevent the HIMatrix systems from operating safely is
permitted.

F3 DIO 16/8 01 3 Product Description
HI 800 177 E Rev. 2.00 Page 13 of 60
3 Product Description
The safety-related F3 DIO 16/8 01 remote I/O is a compact system in a metal housing with
16 digital inputs, 8 2-pole digital outputs and 2 pulsed outputs. The 2-pole outputs consist of
2 switches connected in series, one switching to L+ and the other switching to L-.
The remote I/O is available in various model variants for SILworX and ELOP II Factory, see
Table 4.
Remote I/Os are connected to individual HIMax or HIMatrix controllers via safeethernet. They
are used to extend the I/O level, but are not able to run any user program by themselves.
The remote I/O is suitable for mounting in Ex-zone 2, see Chapter 4.1.6.
The device is TÜV-certified for safety-related applications up to SIL 3 (IEC 61508, IEC 61511
and IEC 62061), Cat. 4 and PL e (EN ISO 13849-1) and SIL 4 (EN 50126, EN 50128 and
EN 50129).
Further safety standards, application standards and test standards are specified in the
certificates available on the HIMA website.
3.1 Safety Function
The remote I/O is equipped with safety-related digital inputs and outputs. The input values on
the inputs are safely transmitted to the connected controller via safeethernet. The outputs are
safely assigned their values by the connected controller via safeethernet.
3.1.1 Safety-Related Digital Inputs
The state (HIGH, LOW) of each input is signaled by an individual LED.
Mechanical contacts without own power supply or signal power source can be connected to the
inputs. Potential-free mechanical contacts without own power supply are fed via an internal
short-circuit-proof 24 V power source (LS+). Each of them supply a group of 4 mechanical
contacts. Figure 1 shows how the connection is performed.
With signal voltage sources, the corresponding ground must be connected to the input (L-), see
Figure 1.
DI 1
LS+
DI 4 DI 3 DI 2
DI 1
L-
DI 4 DI 3 DI 2
Connection of potential-free mechanical
contacts
Connection of signal power sources
Figure 1: Connections to Safety-Related Digital Inputs
Table 18 shows the entire terminal assignment for the digital inputs.
In the default setting, each of the 24 V power sources (LS+) provides a current of 40 mA which
is buffered against power failures for 20 ms.
If higher current is required, the DI Supply[xx] system parameter can be set in the user program
to connect an unbuffered power source (1 A) for each terminal pair (33, 34 and 43, 44) and (53,
54 and 63, 64), see Figure 2 and Figure 3.

3 Product Description F3 DIO 16/8 01
Page 14 of 60 HI 800 177 E Rev. 2.00
The remote I/O reads back the state of the unbuffered power sources and if an overload occurs,
it switches off. The power sources are protected with current limiting components.
Unbuffered Power Source
Buffered Power Source
40 mA Current Limiting
1 A Current Limiting
Terminal Number
Figure 2: Exemplary Structure of Buffered and Unbuffered Power Source
Unbuffered Power Source
Buffered Power Source
40 mA Current Limiting
1 A Current Limiting
Terminal Number
Figure 3: Exemplary Structure of Buffered and Unbuffered Power Source
The connector cables for the inputs are not monitored.
It is not necessary to terminate unused inputs.

F3 DIO 16/8 01 3 Product Description
HI 800 177 E Rev. 2.00 Page 15 of 60
3.1.1.1 Reaction in the Event of a Fault
If the device detects a fault on a digital input, the user program processes a low level in
accordance with the de-energized to trip principle.
The device activates the FAULT LED.
In addition to the channel signal value, the user program must also consider the corresponding
error code.
The error code allows the user to configure additional fault reactions in the user program.
3.1.2 Line Control
Line control is used to detect short-circuits or open-circuits and can be configured for the
remote I/O, e.g., on EMERGENCY STOP inputs complying with Cat. 4 and PL e in accordance
with EN ISO 13849-1.
To this end, connect the pulsed outputs TO 1 and TO 2 of the system to the digital inputs (DI) of
the same system as follows:
EMERGENCY STOP 1
EMERGENCY STOP 2
EMERGENCY STOP switches in
accordance with EN 60947-5-1 and
EN 60947-5-5
Figure 4: Line Control
The remote I/O pulses the pulsed outputs to detect short-circuits and open-circuits on the lines
connected to the digital inputs (DI). To do so, configure the Value [BOOL] -> system variable in
SILworX or the DO[01].Value system signal in ELOP II Factory. The variables for the pulsed
outputs must begin with channel 1 and reside in direct sequence, one after the other.
If the following faults occur, the FAULT LED located on the front plate of the controller blinks,
the inputs are set to low level and an (evaluable) error code is created:
Cross-circuit between two parallel wires.
Invalid connections of two lines (e.g., TO 2 to DI 3),
Earth fault on one wire (with earthed ground only).
Open-circuit or open contacts, i.e., including when one of the two EMERGENCY STOP
switches mentioned above has been engaged, the FAULT LED blinks and the error code is
created.

3 Product Description F3 DIO 16/8 01
Page 16 of 60 HI 800 177 E Rev. 2.00
3.1.3 Safety-Related Digital Outputs
The state (HIGH, LOW) of each output is signaled by an individual LED (HIGH, LOW). The
following block diagram shows how the 2-pole digital outputs are connected:
DO1+
L
+
S
+
DO1
-
W
D
L
-
S
-
W
D
&
&
DOn-
DOn+
Connection to I/O Bus
Current Limiting
Logic
2-Pole Output
Figure 5: Block Diagram for 2-pole Digital Outputs
The 1oo2 processor system directly energizes the digital outputs. Field zone and processor
zone are not galvanically separated. The operating voltage directly supplies the outputs.
If a critical failure occurs, the processor system brings the outputs to the de-energized state
directly, via the I/O bus or indirectly, using the watchdog (second independent shutdown
function).
If communication is lost, the output is set to the initial value configured. This effect must be
taken into account for the behavior of the connected output.
If an overload occurs, one or all digital outputs are switched off. If the overload is removed, the
outputs are switched on again automatically, see Table 14.
3.1.3.1 Reaction in the Event of a Fault
If the device detects a faulty signal on a digital output, the affected module output is set to the
safe (de-energized) state using the safety switches.
If a device fault occurs, all digital outputs are switched off.
In both cases, the devices activates the FAULT LED.
The error code allows the user to configure additional fault reactions in the user program.

F3 DIO 16/8 01 3 Product Description
HI 800 177 E Rev. 2.00 Page 17 of 60
3.1.4 Line Diagnosis with Digital Outputs
The remote I/O is provided with a line diagnosis (short-circuits and open-circuits) for the digital
outputs. Line diagnosis of the digital outputs is only possible when used in a 2-pole
configuration.
The line diagnosis is activated using the Line Monitoring [BOOL] -> system parameter in
SILworX and the DO[xx].LSLB Monitoring system signal in ELOP II Factory.
The line diagnosis measures the impedance of the connected load.
The line diagnosis detects the following faults:
Short-circuit between DO+ and external DO-
Short-circuit between DO+ and external L+
Short-circuit between DO+ and external L-
Short-circuit between DO- and external L+
Short-circuit between DO- and external L-
Open-circuit between DO+ and DO-
The line diagnosis reports detected faults to the user program.
In SILworX, with the system variables -> + Error Code [WORD] or -> - Error Code [WORD].
In ELOP II Factory, with the system signals DO[xx].+Error Code or DO[xx].-Error Code.
Line diagnosis is offered in two operating modes:
Line diagnosis for lamp loads and inductive loads, and
line diagnosis for ohmic, capacitive loads.
iA relay or actuator connected to the output may accidentally be switched on!
A requirement for applications in machine safety is that the outputs DO+, DO- are switched off
if an open-circuit is detected.
iIf the requirements previously described cannot be met, observe the following case:
If a short-circuit occurs between DO- and L-, a relay may be energized or some other actuator
may be set to a different switching state.
Reason: During the monitoring time specified for line diagnosis, a 24 V level (DO+ output) is
present on the load (relay, switching actuator) allowing it to receive enough electrical power to
potentially switch to another state.
The monitoring time must be configured such that an actuator cannot be activated by the line
diagnosis test pulse.
With line diagnosis, set a test period and an adequate monitoring time.
3.1.4.1 Line Diagnosis for Lamp Loads and Inductive Loads
To detect short-circuits, the remote I/O sends a 24 V pulse to the output circuit for the duration
of 500 µs. After this time, it sends a 10 V pulse to detect open-circuits for the duration of the
monitoring time.
Refer to Chapter 4.5.1 for more information on the configuration.

3 Product Description F3 DIO 16/8 01
Page 18 of 60 HI 800 177 E Rev. 2.00
3.1.4.2 Line Diagnosis for Ohmic, Capacitive Loads
To diagnose the line for ohmic and capacitive loads, the remote I/O sends a 10 V test pulse to
the output circuit for the duration of the monitoring time. This type of line diagnosis is particularly
recommended for ohmic and ohmic capacitive loads. With inductive loads or lamp loads, error
messages related to the short-circuit may be generated.
Refer to Chapter 4.5.2 for more information on the configuration.
3.1.4.3 Test Period and Monitoring Time
For line diagnosis, configure the test period and the monitoring time. These time parameters
influence all the channels configured for line diagnosis.
During the monitoring time, the status is read back in 1 ms intervals and, if no faults are
detected, the process values are rewritten to the output. The monitoring time can be set in
intervals of 1 ms between 0 and 50 ms (default value 0 ms).
iThe duration of the monitoring time is added to the cycle time. During the monitoring time, the
output circuit is supplied with a reduced voltage.
The time period can be configured in intervals of 1 s between 1 and 100 s. The interval depends
on following parameters:
Number of test pulses allowed in the external circle.
Monitoring time
If the time period is set to 1 s, a test pulse is sent in intervals of 250 ms for the duration of the
monitoring time.
Within one test period, 4 test pulses are generally pulsed in intervals of 0.25 x time period.
After the period time the line diagnosis is finished and the next line diagnosis cycle starts.

F3 DIO 16/8 01 3 Product Description
HI 800 177 E Rev. 2.00 Page 19 of 60
3.2 Equipment, Scope of Delivery
The following table specifies the available remote I/O variants:
Designation Description
F3 DIO 16/8 01 Remote I/O (16 digital inputs, 8 2-pole digital outputs, 2 pulsed
outputs)
Operating temperature: 0...+60 °C,
for ELOP II Factory programming tool
F3 DIO 16/8 01
SILworX
Remote I/O (16 digital inputs, 8 2-pole digital outputs, 2 pulsed
outputs)
Operating temperature: 0...+60 °C,
for SILworX programming tool
F3 DIO 16/8 014
SILworX
Remote I/O (16 digital inputs, 8 2-pole digital outputs, 2 pulsed
outputs)
Operating temperature: -25...+70 °C (temperature class T1),
Vibration and shock tested according to EN 50125-3 and EN 50155,
class 1B according to IEC 61373,
for SILworX programming tool
Table 4: Available Variants
3.2.1 IP Address and System ID (SRS)
A transparent label is delivered with the device to allow one to note the IP address and the
system ID (SRS for system rack slot) after a change.
IP___.___.___.___SRS____.__.__
Default value for IP address: 192.168.0.99
Default value for SRS: 60 000.200.0 (SILworX)
60 000.0.0 (ELOP II Factory)
The label must be affixed such that the ventilation slots in the housing are not obstructed.
Refer to the First Steps manual of the programming tool for more information on how to modify
the IP address and the system ID.

3 Product Description F3 DIO 16/8 01
Page 20 of 60 HI 800 177 E Rev. 2.00
3.3 Type Label
The type plate contains the following details:
Product name
Bar code (1D or 2D code)
Part no.
Production year
Hardware revision index (HW Rev.)
Firmware revision index (FW Rev.)
Operating voltage
Mark of conformity
Figure 6: Sample Type Label