HIMatrix Safety-Related Controller F31 02 Manual

Introduction

This manual describes the technical characteristics of the device and its use. It provides information on how to install, start up and configure the module.

1.1 Structure and Use of this Manual

The content of this manual is part of the hardware description of the HIMatrix programmable electronic system.

This manual is organized in the following main chapters:

1. Introduction

2. Safety

3. Product Description

4. Start-up

5. Operation

6. Maintenance

7. Decommissioning

8. Transport

9. Disposal

HIMatrix controllers are available for the programming tools SILworX and ELOP II Factory.Which programming tool can be used, depends on the processor operating system of the HIMatrix controller, refer to the following table:

Table 1: Programming Tools for HIMatrix Controllers

In the manual, the differences are specified by using:

1. Separated chapters

2. Tables differentiating among the versions

Table 2: Additional Relevant Documents

The latest manuals can be downloaded from the HIMA website at www.hima.com. The revision index on the footer can be used to compare the current version of existing manuals with the Internet edition.

1.2 Target Audience

This document addresses system planners, configuration engineers, programmers of automation devices and personnel authorized to implement, operate and maintain the modules and systems. Specialized knowledge of safety-related automation systems is required.

Safety Notes

The safety notes are represented as described below.These notes must absolutely be observed to reduce the risk to a minimum. The content is structured as follows:

1. Signal word: warning, caution, notice

2. Type and source of risk

3. Consequences arising from non-observance

4. Risk prevention

Safety

All safety information, notes and instructions specified in this document must be strictly observed. The product may only be used if all guidelines and safety instructions are adhered to.This product is operated with SELV or PELV. No imminent risk results from the product itself.The use in Ex-Zone is permitted if additional measures are taken.

2.1 Intended Use

HIMatrix components are designed for assembling safety-related controller systems.

When using the components in the HIMatrix system, comply with the following general

requirements.

2.2 Environmental Requirements

Residual Risk No imminent risk results from a HIMatrix system itself.

Residual risk may result from:

1. Faults related to engineering

2. Faults related to the user program

3. Faults related to the wiring

2.3 Safety Precautions ，Observe all local safety requirements and use the protective equipment required on site.

2.4 Emergency Information

A HIMatrix system is a part of the safety equipment of a site. If a device or a module fails, the system enters the safe state.In case of emergency, no action that may prevent the HIMatrix systems from operating safely is permitted.

Product Description：

The safety-related F31 02 controller is a compact system in a metal housing with 20 digital inputs and 8 digital outputs.

The controller is available in various model variants for SILworX and ELOP II Factory, see Table 4.

The device is suitable for mounting in Ex-zone 2, see Chapter 4.1.4.

The device is TÜV-certified for safety-related applications up to SIL 3 (IEC 61508, IEC 61511 and IEC 62061), Cat. 4 and PL e (EN ISO 13849-1) and SIL 4 (EN 50126, EN 50128 and EN 50129). Further safety standards, application standards and test standards are specified in the certificates available on the HIMA website.

3.1 Safety Function 

The controller is equipped with safety-related digital inputs and outputs.

3.2 Safety-Related Digital Inputs

The controller is equipped with 20 digital inputs. The state (HIGH, LOW) of each input is signaled by an individual LED.Mechanical contacts without own power supply or signal power source can be connected to the inputs.

Potential-free mechanical contacts without own power supply are fed via an internal shortcircuit-proof 24 V power source (LS+). Each of them supply a group of 4 mechanical contacts.

Figure 1 shows how the connection is performed.With signal voltage sources, the corresponding ground must be connected to the input (L-),

3.3 Reaction in the Event of a Fault

If the device detects a fault on a digital input, the user program processes a low level in accordance with the de-energized to trip principle.The device activates the FAULT LED.In addition to the channel signal value, the user program must also consider the corresponding error code.The error code allows the user to configure additional fault reactions in the user program.

3.4 Line Control

Line control is used to detect short-circuits or open-circuits and can be configured for the F31 system, e.g., on EMERGENCY STOP inputs complying with Cat. 4 and PL e in accordance with EN ISO 13849-1.To this end, connect the digital outputs DO 1 through DO 8 of the system to the digital inputs DI of the same system as follows:

The controller pulses the digital outputs to detect the line short-circuits and open-circuits on the lines connected to the digital inputs. To do so, configure the Value [BOOL] -> system variable in SILworX or the DO[01].Value system signal in ELOP II Factory. The variables for the pulsed outputs must begin with channel 1 and reside in direct sequence, one after the other.If the following faults occur, the FAULT LED located on the front plate of the controller blinks,the inputs are set to low level and an (evaluable) error code is created:

1. Cross-circuit between two parallel wires.

2. Invalid connections of two lines (e.g., DO 2 to DI 3),

3. Earth fault on one wire (with earthed ground only).

4. Open-circuit or open contacts, i.e., including when one of the two EMERGENCY STOP switches mentioned above has been engaged, the FAULT LED blinks and the error code is created.

3.5 Safety-Related Digital Outputs

The controller is equipped with 8 digital outputs. The state (HIGH, LOW) of each output is signaled by an individual LED (HIGH, LOW).At the maximum ambient temperature, the outputs 1...3 and 5...7 can be loaded with 0.5 A each; and outputs 4 and 8 can be loaded with 1 A or with 2 A at an ambient temperature of up to 50 °C.If an overload occurs, one or all digital outputs are switched off. If the overload is removed, the outputs are switched on again automatically, see Table 17.The external wire of an output is not monitored, however, a detected short-circuit is signaled.

3.6 Reaction in the Event of a Fault

If the device detects a faulty signal on a digital output, the affected module output is set to the safe (de-energized) state using the safety switches.If a device fault occurs, all digital outputs are switched off.In both cases, the devices activates the FAULT LED.The error code allows the user to configure additional fault reactions in the user program.

3.7 Structure

This chapter describes the layout and function of the controller, and its connection for communication.

LED Indicators

The light-emitting diodes (LEDs) indicate the operating state of the controller. The LEDs are classified as follows:

1. Operating voltage LED

2. System LEDs

3. Communication LEDs

4. I/O LEDs

Function and meaning of the system LEDs and communication LEDs depend on the CPU operating system (and thus on the COM operating system).When the supply voltage is switched on, a LED test is performed and all LEDs are briefly lit.Definition of Blinking Frequencies The following table defines the blinking frequencies of the LEDs:The key can be accessed through a small round hole located approximately 5 cm from the upper left-hand side of the housing. The key is engaged using a suitable pin made of insulating material to avoid short-circuits within the controller.The reset is only effective if the controller is rebooted (switched off and on) while the key is simultaneously engaged for at least 20 s. Engaging the key during operation has no effect.

Properties and behavior of the controller after a reboot with engaged reset key:

1. Connection parameters (IP address and system ID) are set to the default values.

2. All accounts are deactivated except for the administrator default account with empty password.

3. With COM operating system version 10.42 and higher, loading a user program or operating

system with default connection parameters is inhibited!

The loading procedure is only allowed after the connection parameters and the account have been configured on the controller and the controller has been rebooted.After a new reboot without the reset key engaged, the connection parameters (IP address and system ID) and accounts become effective.

1. Those configured by the user.

2. Those valid prior to rebooting with the reset key engaged, if no changes were performed.