HIMA HIMatrix F35 Safety Controller: Specification Manual, SIL 3 Programming and Installation Guide

HIMA HIMatrix F35 Safety Controller: Specification Manual, SIL 3 Programming and Installation Guide

1. System Overview: HIMatrix F35 Compact Safety Controller

HIMatrix F35 is a compact controller designed specifically for industrial automation safety applications. The device is integrated into a metal casing and provides comprehensive I/O interfaces, enabling SIL 3 level safety functions without the need for complex modular cabinets.

Core configuration and authentication:

Safety level: Certified by T Ü V, compliant with IEC 61508 SIL 3, IEC 61511, and IEC 62061 standards.

Performance level: Complies with EN 954-1 Cat. 4 and EN ISO 13849-1 PL e standards.

Explosion proof certification: applicable to Zone 2 (ATEX) explosion-proof area.

Certification bodies: T Ü V, UL, FM approvals, Lloyd's Register, etc.

Main I/O scale:

24 digital inputs (DI): Supports mechanical contact or signal source connections.

8 digital outputs (DO): Supports direct load driving and has overload protection.

2 counters: supports multiple modes (counting, Gray code decoding).

8 analog inputs (AI): supports voltage (0-10V) and current (0-20mA) measurement.

2. Security architecture and functional design

The safety design of F35 controller is based on the principles of "de excitation trip" and "live trip". This means that in the event of a malfunction, the system will automatically enter a defined safe state (usually a de excitation state).

2.1 Safety Related Digital Input (DI)

Signal processing: Input signals are collected as analog measurement values and converted to Boolean values through configurable thresholds. The default setting is: low level<7V, high level>13V.

Line monitoring: Although the digital input of F35 itself does not require line monitoring, an open circuit is considered a safe (low level) state.

Power supply: For mechanical contacts without independent power supply, the controller provides a 24V power supply (LS+) with short-circuit protection internally.

2.2 Safety Related Digital Output (DO)

Fault response: If an output fault (such as a short circuit) is detected, the affected output channel will immediately switch to a safe (de excitation) state through a safety switch.

Overload protection: If an overload occurs, the affected output or all outputs will be turned off and automatically restored after troubleshooting.

Line monitoring support: The analog input of F35 can be used to monitor the open and short circuits of digital outputs, thereby achieving SIL 3 compliant line integrity monitoring.

2.3 Safety related counters

Resolution: 24 bit resolution, maximum count value is

2 24−1=16,777,2152 

pattern

Counting function 1: Depending on the counting direction input signal, it supports up/down counting.

Counting function 2: It is independent of the input signal in the counting direction and is controlled by the program to add/subtract.

Decoding operation: used to connect the absolute value rotary encoder (3-bit Gray code).

2.4 Safety related Analog Input (AI)

Measurement range: 0... 10 V DC or 0... 20 mA (via shunt resistor).

Accuracy: The safety related accuracy is ± 2% (final value).

Safety principle: The input signal is evaluated according to the principle of de excitation tripping.

3. Hardware variants and technical specifications

The F35 series offers three main model variants to meet different environmental temperatures and installation requirements. The following is a detailed model list and product data:

3.1 Model List

Model description programming tool supports part numbers

F35 01 standard type, working temperature 0...+60 ° C SILworX/ELOP II Factory 98 220 0416/0473

F35 011 (-20 ° C) low temperature type, working temperature -20...+60 ° C SILworX/ELOP II Factory 98 220 0453/0476

F35 012 (Subsea/-20 ° C) Subsea/Low Temperature Type, V2A Stainless Steel Case, Compliant with ISO 13628-6:2006 SILworX/ELOP II Factory 98 220 0454/0477

*Note: The electronic components of F35 011 and F35 012 are coated with protective varnish to adapt to harsh environments. The F35 012 chassis is equipped with solid aluminum plates for installation. *

3.2 Core Technical Specifications

Supply voltage: 24 V DC, allowable deviation -15%...+20%, ripple factor ≤ 5%.

Current input: maximum 9 A (full load), no load 0.5 A.

Protection level: IP20 (standard).

Protection level: Class III (IEC/EN 61131-2).

Storage temperature: -40...+85 ° C.

User memory: V7.0 and above versions have a maximum of 1023 kB for user programs and 1023 kB for user data.

Response time: ≥ 20 ms.

Weight: Approximately 1.2 kg (F35 01/F35 011), 1.7 kg (F35 012).

Dimensions: Width 257mm, Height 114mm, Depth 97mm (excluding plugins and mounting plates).

4. Programming and Configuration: SILworX and ELOP II Factory

The configuration tool for F35 controller depends on its operating system (OS) version:

OS version 7 and above: Use SILworX for configuration.

OS version 7 and below: Use ELOP II Factory for configuration.

4.1 SILworX configuration key points (OS>=7)

In SILworX hardware, F35 is considered as a basic rack and includes the following module configurations:

Processor module (CPU)

Communication Module (COM)

Output module (DO 8)

Counter module (HSC 2)

Input module (MI 24/8)

System parameters and error codes:

Users can read detailed error codes through system variables.

Example of digital output error code:

0x0001: Digital output internal fault.

0x0002: MOT test for safety switch 1 returned a fault.

0x0200: All outputs are turned off, total current exceeds limit.

Example of simulated input error code:

0x0004: MOT Test: Conversion Time Monitoring.

0x0008: FTT test: Data bus inspection fault.

4.2 Connection variants and configurations

F35 supports special connection variants to meet specific security application requirements:

4.2.1 Mechanical contact connections on analog inputs

Connect the mechanical contacts to the analog input through the Z 7308 shunt adapter. This connection method utilizes analog input to measure the contact state.

Switch threshold (FS 2000 setting):

Conduction threshold (L ->H): 6 V (1200 bits).

Turn off threshold (H ->L): 3 V (600 bits).

LB threshold (fault): ≤ 0.5 V (100 bits).

LS threshold (fault): ≥ 8.4 V (1680 bits).

4.2.2 Mechanical contact connections on digital inputs

Digital inputs can be connected to mechanical contacts for status monitoring. One set of 8 input power supplies (LS+) must be monitored by another digital input.

Switch threshold:

Conduction threshold:>12V (1200 bits).

Shutdown threshold:<10 V (1000 bits).

LB threshold (fault):<2 V (200 bits).

LS threshold (fault): Power supply voltage -1.1 V (1100 bit).

5. Communication capability and network interface

The F35 controller integrates powerful communication capabilities, supports safety related SafeEthernet, and multiple standard fieldbus protocols.

5.1 Ethernet Communication

Integrated switch: The controller integrates a secure Ethernet switch internally for connecting remote I/O or PADT (programming and debugging tool).

Interface: 4 RJ-45 interfaces, supporting 10/100Base-T, automatic negotiation and automatic crossover.

Security protocol: SafeEthernet (Safety Related Communication).

Standard protocols: EtherNet/IP, OPC, Modbus TCP, SNTP, etc.

Network Port Allocation (UDP/TCP):

8000: SILworX programming and operation.

8001: Remote I/O configuration (ELOP II Factory).

8004: Remote I/O configuration (SILworX).

6010: SafeEthernet and OPC.

123: SNTP time synchronization.

5.2 Fieldbus interfaces (FB1, FB2, FB3)

F35 provides three D-sub connectors for installing fieldbus modules:

Supported protocols: PROFIBUS DP Master/Slave, Modbus Master/Slave, INTERBUS Master, RS485, RS232.

Note: The INTERBUS protocol is not supported in SILworX.

6. Installation, wiring, and environmental conditions

6.1 Environment and Mechanical Installation

Operating Temperature

F35 01: 0…+60 °C

F35 011/012: -20…+60 °C

Installation method: 35 mm DIN rail installation or mounting plate (F35 012).

Protection level: IP20. If installed in Zone 2, it must be installed in a cabinet with a protection level of at least IP54 and comply with EN 60079-15 requirements.

ESD protection: Operators must have ESD protection knowledge and wear anti-static wristbands.

6.2 Wiring specifications

Digital Input (DI): Supports mechanical contact connections. Each group of 8 inputs shares one power supply (LS+). The maximum length of the line is 300 meters.

Digital output (DO): Pay attention to the load connection. For single pole switch output, the corresponding channel group negative pole (L -) connection must be used to ensure effective internal protection circuit.

Analog Input (AI): Shielded twisted pair cables with a maximum length of 300 meters must be used. Unused analog inputs must be short circuited. To measure voltage, the internal resistance of the external source needs to be considered, and the channel needs to be terminated by a 10 k Ω resistor.

Counter: The maximum wire length is 500 meters, and shielded twisted pair cables must be used.

7. Diagnosis, LED indication and maintenance

7.1 LED Indicator System

The F35 controller is equipped with rich LED indicators on the front for quick diagnosis of system status:

RUN (green): The device is in RUN state and executing user programs normally.

ERROR (red): An internal fault (hardware, software, or watchdog timeout) has been detected, entering the ERROR STOP state.

PROG (yellow): Loading new configuration.

FORCE (yellow): The forced function has been activated.

FAULT (yellow): The loaded configuration is defective.

I/O LEDs (yellow): indicate the activation status of each input/output channel.

7.2 Maintenance Measures

Regular testing: It is recommended to recalibrate the analog input every 10 years. Conduct a Proof Test every 10 years, referring to the Safety Manual (HI 800 023 E).

Operating System Update: HIMA continuously improves the operating system and recommends using the latest version.

Fault handling: For OS versions 6.42 and above, if a fault is detected during self inspection, the device will restart; If the malfunction occurs again within one minute, the device will enter the STOP_INVALID state.