Axioline F safety module with

safe digital inputs

User manual
User manual
Axioline F safety module with safe digital inputs

2016-11-10

Designation: UM EN AXL F SSDI8/4 1F

Revision: 01

This user manual is valid for:

Designation From HW/FW Order No.

revision
AXL F SSDI8/4 1F 01/220 2702263

PHOENIX CONTACT 106887_en_01

 Please observe the following notes
User group of this manual
The use of products described in this manual is oriented exclusively to:
– Qualified electricians or persons instructed by them, who are familiar with applicable
standards and other regulations regarding electrical engineering and, in particular, the
relevant safety concepts.
– Qualified application programmers and software engineers, who are familiar with the
safety concepts of automation technology and applicable standards.
Explanation of symbols used and signal words
This is the safety alert symbol. It is used to alert you to potential personal injury
hazards. Obey all safety measures that follow this symbol to avoid possible
injury or death.
There are three different categories of personal injury that are indicated with a
signal word.
DANGER This indicates a hazardous situation which, if not avoided, will
result in death or serious injury.
WARNING This indicates a hazardous situation which, if not avoided, could
result in death or serious injury.
CAUTION This indicates a hazardous situation which, if not avoided, could
result in minor or moderate injury.
This symbol together with the signal word NOTE and the accompanying text
alert the reader to a situation which may cause damage or malfunction to the
device, hardware/software, or surrounding property.
This symbol and the accompanying text provide the reader with additional
information or refer to detailed sources of information.

How to contact us

Internet Up-to-date information on Phoenix Contact products and our Terms and Conditions can be
found on the Internet at:
phoenixcontact.com
Make sure you always use the latest documentation.
It can be downloaded at:
phoenixcontact.net/products

Subsidiaries If there are any problems that cannot be solved using the documentation, please contact
your Phoenix Contact subsidiary.
Subsidiary contact information is available at phoenixcontact.com.

Published by PHOENIX CONTACT GmbH & Co. KG

Flachsmarktstraße 8
32825 Blomberg
GERMANY
Should you have any suggestions or recommendations for improvement of the contents and
layout of our manuals, please send your comments to:
[email protected]

PHOENIX CONTACT
Please observe the following notes

General terms and conditions of use for technical documentation

Phoenix Contact reserves the right to alter, correct, and/or improve the technical
documentation and the products described in the technical documentation at its own
discretion and without giving prior notice, insofar as this is reasonable for the user. The
same applies to any technical changes that serve the purpose of technical progress.
The receipt of technical documentation (in particular user documentation) does not
constitute any further duty on the part of Phoenix Contact to furnish information on
modifications to products and/or technical documentation. You are responsible to verify the
suitability and intended use of the products in your specific application, in particular with
regard to observing the applicable standards and regulations. All information made
available in the technical data is supplied without any accompanying guarantee, whether
expressly mentioned, implied or tacitly assumed.
In general, the provisions of the current standard Terms and Conditions of Phoenix Contact
apply exclusively, in particular as concerns any warranty liability.
This manual, including all illustrations contained herein, is copyright protected. Any
changes to the contents or the publication of extracts of this document is prohibited.
Phoenix Contact reserves the right to register its own intellectual property rights for the
product identifications of Phoenix Contact products that are used here. Registration of such
intellectual property rights by third parties is prohibited.
Other product identifications may be afforded legal protection, even where they may not be
indicated as such.

PHOENIX CONTACT
 Table of contents

Table of contents
1 For your safety ............................................................................................................................9
1.1 General safety notes.............................................................................................. 9
1.2 Electrical safety ................................................................................................... 10
1.3 Safety of the machine or system.......................................................................... 11
1.4 Directives and standards ..................................................................................... 11
1.5 Intended use ....................................................................................................... 11
1.6 Documentation .................................................................................................... 12
1.7 Abbreviations used ............................................................................................ 12
1.8 Safety hotline....................................................................................................... 12

2 Product description...................................................................................................................13
2.1 Short description of the module ........................................................................... 13
2.2 Structure of the module ....................................................................................... 14
2.3 Housing dimensions ............................................................................................ 14
2.4 Safe digital inputs ................................................................................................ 15
2.5 Clock outputs T1 and T2...................................................................................... 16
2.6 Connection options for sensors depending on the parameterization ................... 18
2.7 Local diagnostics and status indicators ............................................................... 19
2.8 Safe state ............................................................................................................ 21
2.8.1 Operating state .................................................................................... 21
2.8.2 Error detection in I/O devices ............................................................... 21
2.8.3 Device errors ....................................................................................... 22
2.8.4 Parameterization errors ........................................................................ 22
2.9 Process data words ............................................................................................. 23
2.10 Programming data/configuration data.................................................................. 23

3 Integration of the Axioline F local bus .......................................................................................25

3.1 Supply voltage of the module logic ...................................................................... 25
3.2 Supply voltage UI ................................................................................................. 25
3.3 DC distribution network according to IEC 61326-3-1 ........................................... 26
3.4 Terminal point assignment................................................................................... 27

106887_en_01 PHOENIX CONTACT 5

AXL F SSDI8/4 1F

4 Assembly, removal, and electrical installation ..........................................................................29

4.1 Assembly and removal ........................................................................................ 29
4.1.1 Unpacking the module ......................................................................... 29
4.1.2 Preparation and assembly ................................................................... 29
4.1.3 Setting the DIP switch .......................................................................... 30
4.1.4 Mounting and removing modules ........................................................ 31
4.2 Electrical installation ............................................................................................ 33
4.2.1 Electrical installation of the Axioline F station ....................................... 33
4.2.2 Electrical installation of the module ...................................................... 33

5 Parameterization of the module ................................................................................................35

5.1 Parameterization in a SafetyBridge system ......................................................... 35
5.2 Parameterization of the safe inputs...................................................................... 36

6 Duration of a safety demand .....................................................................................................39

7 Connection examples for safe inputs ........................................................................................41

7.1 Explanation of the examples................................................................................ 41
7.2 Measures to achieve a specific safety integrity.................................................... 42
7.3 Single-channel assignment of safe inputs ........................................................... 44
7.3.1 Notes ................................................................................................... 44
7.3.2 Cross-circuit monitoring enabled ......................................................... 44
7.3.3 Cross-circuit monitoring disabled, supply through T1 .......................... 46
7.3.4 Supply through OSSD .......................................................................... 48
7.4 Two-channel equivalent assignment of safe inputs ............................................. 50
7.4.1 Notes on errors .................................................................................... 52
7.4.2 Cross-circuit monitoring enabled, supply through T1 and T2 .............. 53
7.4.3 Cross-circuit monitoring disabled, supply through a clock
output or external supply ...................................................................... 55
7.4.4 External supply (OSSD) ....................................................................... 58
7.5 Two-channel non-equivalent assignment of safe inputs ...................................... 60
7.5.1 Notes on errors .................................................................................... 62
7.5.2 Cross-circuit monitoring enabled, supply through T1 and T2 ............... 63
7.5.3 Cross-circuit monitoring disabled, supply through a clock
output or external supply ...................................................................... 64

6 PHOENIX CONTACT 106887_en_01

 Table of contents

8 Startup and validation ...............................................................................................................67

8.1 Initial startup ........................................................................................................ 67
8.1.1 Startup mode ....................................................................................... 68
8.2 Restart after replacing a module.......................................................................... 69
8.2.1 Replacing a module ............................................................................. 69
8.2.2 Restart ................................................................................................. 69
8.3 Validation............................................................................................................. 69

9 Errors: messages and removal .................................................................................................71

9.1 Displaying and reading errors.............................................................................. 71
9.2 Acknowledging an error....................................................................................... 71
9.3 Module replacement following an error................................................................ 71
9.4 Note about the error codes .................................................................................. 72
9.5 Error codes.......................................................................................................... 73

10 Maintenance, repair, decommissioning, and disposal ..............................................................77

10.1 Maintenance........................................................................................................ 77
10.2 Repair.................................................................................................................. 77
10.3 Decommissioning and disposal ........................................................................... 77

11 Technical data and ordering data .............................................................................................79

11.1 SafetyBridge system data.................................................................................... 79
11.2 AXL F SSDI8/4 1F module data........................................................................... 79
11.3 Conformance with EMC Directive........................................................................ 83
11.4 Ordering data: module......................................................................................... 83
11.5 Download data: software ..................................................................................... 83
11.6 Download data: documentation ........................................................................... 84

A Appendix: checklists .................................................................................................................85

A1 Planning ........................................................................................................... 86
A2 Assembly and electrical installation ................................................................. 87
A3 Startup and parameterization ......................................................................... 88
A4 Validation .......................................................................................................... 89

B Appendix: index ........................................................................................................................91

C Appendix: revision history.........................................................................................................93

106887_en_01 PHOENIX CONTACT 7

AXL F SSDI8/4 1F

8 PHOENIX CONTACT 106887_en_01

 For your safety

1 For your safety

Purpose of this user manual
This user manual provides information about how the module works, its operating and
connection elements, and its parameter settings.

Validity of the user manual

This user manual is valid for the AXL F SSDI8/4 1F module in the version indicated on the
inner cover page, as well as for the same or later versions if replaced with devices of the
same type.

1.1 General safety notes

WARNING: Risk of injury

Depending on the application, inappropriate use of the module may result in serious injury.
• Observe all the safety notes and warning instructions provided in this section and
elsewhere in this user manual.

Qualified personnel In terms of this user manual, qualified personnel are persons who, because of their
education, experience and instruction, and their knowledge of relevant standards,
regulations, accident prevention, and service conditions, have been authorized to carry out
any required operations, and who are able to recognize and avoid any possible dangers.
Furthermore, knowledge of the following topics and products is required:
– Non-safety-related target system (e.g., PROFIBUS, PROFINET, EtherCAT)
– SafetyBridge system
– Components used
– Axioline F product range
– Operation of the software tools
– Safety regulations in the field of application
In the context of the use of the system, the following operations must only be carried out by
qualified personnel:
– Planning
– Configuration, parameterization, programming
– Installation, startup, servicing
– Maintenance, decommissioning

Documentation Observe all information in this user manual and the accompanying documents: see
Section 1.6 “Documentation” on page 12.

Safety of personnel and The safety of personnel and equipment can only be assured if the module is used correctly:
equipment see Section 1.5 “Intended use” on page 11.

Error detection Depending on the wiring and the parameterization, the module detects errors within the
safety equipment.

106887_en_01 PHOENIX CONTACT 9

AXL F SSDI8/4 1F

Do not carry out It is prohibited for the user to carry out repair work or make modifications to the module. The
any repairs or housing must not be opened. The module is protected against tampering by means of
modifications security labels. The security label is damaged in the event of unauthorized repairs or
opening of the housing. In this case, the correct operation of the safety module can no
longer be ensured.
In the event of an error, send the module to Phoenix Contact or contact Phoenix Contact
immediately and engage a service engineer.

Mismatching and polarity Take care to avoid the mismatching, polarity reversal or tampering of connections. For
reversal of connections increased protection against mismatching, connectors and slot markings are color coded.

1.2 Electrical safety

WARNING: Loss of safety function/hazardous shock currents

Incorrect installation can result in the loss of the safety function as well as hazardous shock
currents.
• Observe the notes on electrical safety.
• Plan the modules used and their installation in the system according to the specific
requirements.
• Recheck plants and systems retrofitted with SafetyBridge.

Direct/indirect contact Protection against direct and indirect contact according to VDE 0100 Part 410 must be
ensured for all components connected to the system. In the event of an error, parasitic
voltages must not occur (single-fault tolerance).
Measures required:
– Using power supply units with safe isolation (PELV).
– Decoupling circuits, which are not PELV systems, using optocouplers, relays, and other
components which meet the requirements of safe isolation.

Power supply units for 24 Only use power supply units with safe isolation and PELV according to EN 50178/VDE 0160
V supply (PELV). These power supply units prevent short circuits between the primary and
secondary side.
Make sure that the output voltage of the power supply does not exceed 32 V even in the
event of an error.

Insulation rating When selecting the equipment, please take into consideration the dirt and surge voltages
which may occur during operation.
The module is designed for overvoltage category II (according to DIN EN 60664-1). If you
expect surge voltages in the system, which exceed the values defined in overvoltage
category II, implement additional measures for voltage limitation.

10 PHOENIX CONTACT 106887_en_01

 For your safety

1.3 Safety of the machine or system

The machine/system manufacturer and the operator are responsible for the safety of the
machine or system and the application in which the machine or system is used.

Draw up and implement a In order to use the module, a safety concept is required for your machine or system. This
safety concept includes a hazard and risk analysis as well as a test report (checklist) for validating the
safety function: see Section 1.4 “Directives and standards” on page 11 and see Section A
“Appendix: checklists” on page 85.
The target safety integrity (SIL according to IEC 61508, SILCL according to EN 62061 or
performance level and category according to EN ISO 13849-1) is ascertained on the basis
of the risk analysis. The safety integrity ascertained determines how to connect and
parameterize the module within the safety function.

Validate hardware and Carry out a validation every time you make a safety-related modification to your overall
parameterization system.
Use your test report to ensure that:
– The safe modules are connected to the correct sensors and actuators
– The safe input and output channels have been parameterized correctly
– The variables have been linked to the safe sensors and actuators (single-channel or
two-channel) correctly

1.4 Directives and standards

The standards to which the module conforms are listed in the certificate issued by the
approval body and in the EC declaration of conformity (see: phoenixcontact.net/products).

1.5 Intended use

The AXL F SSDI8/4 1F module is designed exclusively for use in a SafetyBridge system. It
can only perform its tasks in the system if it is used according to the specifications in this
document.
Only use the module according to the defined technical data and ambient conditions: see
Section 11 “Technical data and ordering data” on page 79.
The module is designed for connecting single-channel or two-channel sensors, which can
be used in association with safety technology.
Examples of use for the module:
– Single or two-channel emergency stop equipment or safety door equipment
– Applications with enable button
– Applications with two-hand control devices
– Applications with mode selector switches
– As secondary switchgear for safety-related photoelectric barriers
– Safety circuits according to EN 60204, Part 1

106887_en_01 PHOENIX CONTACT 11

AXL F SSDI8/4 1F

1.6 Documentation

Currentness and Always use the latest documentation. Changes or additions to documentation can be found
availability of on the Internet (see: phoenixcontact.net/products).
documentation

SafetyBridge user User manuals:

manuals – For the controller used
– For the logic module of the SafetyBridge system
– For the SafetyBridge system I/O modules used
– For the SafetyBridge system function blocks
Please also observe the information on the bus system used.

Documentation for the Axioline F: system and installation user manual, UM EN AXL F SYS INST
Axioline F product range
Documentation for the bus coupler used

1.7 Abbreviations used

Table 1-1 Abbreviations for safety requirements

Abbreviatio Meaning Standard Example

n
SIL Safety integrity level IEC 61508 SIL 2, SIL 3
SILCL SIL claim limit EN 62061 SILCL 3
Cat. Category EN ISO 13849-1 Cat. 2, Cat. 4
PL Performance level EN ISO 13849-1 PL e, PL d

Table 1-2 General abbreviations

Abbreviatio Meaning
n
PELV Protective extra-low voltage according to EN 50178/VDE 0160
EUC Equipment under control

1.8 Safety hotline

Should you have any technical questions, please contact our 24-hour hotline.
Phone: + 49 5281 9-46277, e-mail: [email protected]

12 PHOENIX CONTACT 106887_en_01

 Product description

2 Product description

2.1 Short description of the module

The AXL F SSDI8/4 1F module is an input module for use at any point in an Axioline F
station.
The module is designed for use in the SafetyBridge system. The SafetyBridge address is
set via a DIP switch.
The module has four safe digital inputs for two-channel assignment or eight safe digital
inputs for single-channel assignment.
The inputs can be parameterized according to the specific application and enable the
integration of sensors in the safe SafetyBridge system.
In the SafetyBridge system, the module can be used to achieve safety functions with the
following requirements depending on the operating conditions:
– Up to SIL 3 according to IEC 61508
– Up to SILCL 3 according to EN 62061
– Up to Cat. 4/PL e according to EN ISO 13849-1

106887_en_01 PHOENIX CONTACT 13

AXL F SSDI8/4 1F

2.2 Structure of the module

7
6
5

4
3
2

Figure 2-1 Structure of the module

1 Bus base module

2 Electronics module
3 Connector for connecting the supply voltage
4 Function identification
5 I/O connector
6 Diagnostics and status indicators
7 DIP switch

More detailed information on setting the switch: see Section 4.1.3 “Setting the DIP switch”
on page 30.

2.3 Housing dimensions

53,6 54
122,4
126,1

Figure 2-2 Housing dimensions (in mm)

14 PHOENIX CONTACT 106887_en_01

 Product description

2.4 Safe digital inputs

The module has safe digital inputs which can be used as follows:
– For two-channel assignment: four two-channel inputs
– For single-channel assignment: eight single-channel inputs
Technical data for the safe inputs: see “Safe digital inputs” on page 81. The supply voltage
for the inputs can be provided externally or via the clock outputs.

Parameterization The safe digital inputs of the module can be parameterized in pairs. This means that the
inputs can be adapted to various operating conditions and different safety integrity levels
can be implemented (SIL, SILCL, Cat., PL).

The safety integrity (SIL, SILCL, Cat., PL) and error detection that can be achieved
depend on the parameterization, the structure of the sensor, and the cable installation: see
Section 7 “Connection examples for safe inputs” on page 41.
Information on the parameterization of the inputs: see Section 5.2 “Parameterization of the
safe inputs” on page 36.

Diagnostics Diagnostics are provided via both the local diagnostics indicators and the diagnostic
messages which are transmitted to the logic module.
Information on the diagnostic messages of the inputs: see Section 9 “Errors: messages and
removal” on page 71.

WARNING: Loss of safety function

Using diagnostic data for safety-related functions can result in the loss of the safety
function as diagnostic data is not safety-related.
• Do not use the diagnostic data for safety-related functions or actions.

Requirements for Functional safety places requirements on the design of sensors/controlling devices.
sensors/controlling • Use suitable sensors/controlling devices which are described in the applicable safety
devices standards, for example.
The module's ability to detect errors depends on the parameterization.
• Adapt the module parameterization to the relevant sensor/controlling device: see
Section 5 “Parameterization of the module” on page 35.

106887_en_01 PHOENIX CONTACT 15

AXL F SSDI8/4 1F

2.5 Clock outputs T1 and T2

The module has two independent clock outputs. These clock outputs provide the supply
voltage for the safe inputs. Both clock outputs provide a pulse pattern to detect cross-
circuits in the external wiring of the inputs if cross-circuit monitoring has been activated for
at least one input pair.

Typical pulse pattern

T T T
1 ms 1 ms 1 ms
T1

1
0
10 20 30 40 50 60 70 80 90 100 110 t [ms]
T T T
1 ms 1 ms 1 ms
T2

1
0
10 20 30 40 50 60 70 80 90 100 110 t [ms]
Figure 2-3 Typical pulse pattern

Key:

T Test pulse
Pulse width ≤ 1 ms
Period length ≤ 40 ms

The clock outputs are also switched on and monitored when the module is not
parameterized. If a short circuit occurs at a clock output when it is in this state, the clock
output is switched off.

Technical data for the clock outputs: see “Clock outputs” on page 82.

Behavior in the event of an In the event of short circuit to GND or overload of the clock outputs, the clock outputs are
error switched off. A diagnostic message is generated and the message is indicated via the SD
LED. This error must be acknowledged so that the system can be started up again following
error removal, see see “Errors: messages and removal” on page 71.
As there are two clock outputs for eight inputs, there may be reciprocal effects between the
inputs.

16 PHOENIX CONTACT 106887_en_01

 Product description

Diagnostics

WARNING: Loss of safety function

Using diagnostic data for safety-related functions can result in the loss of the safety
function as diagnostic data is not safety-related.
• Do not use the diagnostic data for safety-related functions or actions.
Diagnostics are provided via both the local diagnostics indicators and the diagnostic
messages which are transmitted to the logic module.
Information on the diagnostic messages: see Section 9 “Errors: messages and removal” on
page 71.

Cross-circuit monitoring If all inputs are parameterized without cross-circuit monitoring, a DC voltage can be tapped
at the clock outputs without clock pulses. As soon as cross-circuit monitoring has been
parameterized for at least one input pair, pulses are output at clock outputs T1 and T2.
For inputs that are parameterized with cross-circuit monitoring, the assignment is as
follows:
– Inputs for channel 1 (INx_CH1) are assigned to clock output T1.
– Inputs for channel 2 (INx_CH2) are assigned to clock output T2.
Observe the information on error detection according to clocking: see Section 2.5 “Clock
outputs T1 and T2” on page 16.

106887_en_01 PHOENIX CONTACT 17

AXL F SSDI8/4 1F

2.6 Connection options for sensors depending on the

parameterization

Sensors that meet various safety requirements depending on the parameterization can be
connected to the inputs.
The maximum achievable SIL/SILCL/Cat./PL is specified in the table.
In order to meet the safety requirements:
• Observe the information in the connection examples: see Section 7 “Connection
examples for safe inputs” on page 41.
• Observe the requirements of the standards with regard to the external wiring and the
sensors to be used to achieve a SIL/SILCL/Cat./PL: see Section 7.2 “Measures to
achieve a specific safety integrity” on page 42.

Input
Connection to the Single-channel sensor or redundant Two-channel redundant controlling device/sensor
Axioline F connectors sensor
Input signal Equivalent Non-equivalent
Cross-circuit monitoring With Without With Without With Without
Sensors that can be
connected:
– Contact-based Yes Yes - Yes Yes - Yes Yes
– With OSSD No - Yes No - Yes No No
outputs
Achievable SIL 2 2 2 3 3 3 3 3
safety integrity SILCL 2 2 2 3 3 3 3 3
Cat. 3* 2 2 4 3 4** 4 3
PL d d d e d e e d
For connection example, 44 46 48 53 55 58 63 64
see page

* Cat. 3 can only be achieved with a redundant sensor.

** The category that can be achieved depends on the sensor used.

18 PHOENIX CONTACT 106887_en_01

 Product description

2.7 Local diagnostics and status indicators

D 00 01 02 03 04 05 06 07
UI

FS P CM SD
Figure 2-4 Local diagnostics and status indicators

Table 2-1 Overview of diagnostics LEDs

Des. Color State Description

D Red/yellow/ Diagnostics for local bus communication
green Green on The device is ready for operation, communication within the station is OK.
All data is valid. There is no error.
Flashing green The device is ready for operation, communication within the station is OK.
The data is not valid. Valid data from the controller/higher-level network not
available.
There is no error on the module.
Flashing The device is ready for operation, communication within the station is OK.
green/yellow Output data cannot be output and/or input data cannot be read.
There is an error on the I/O side of the module.
Yellow on The device is ready for operation, but has still not detected a valid cycle
after power on.
Flashing The device is not (yet) part of the active configuration.
yellow
Red on The device is ready for operation, but has lost the connection to the bus
head.
Flashing red The device is ready for operation, but there is no connection to the previous
device.
Off Device is in (power) reset.
UI Green Diagnostics for digital input supply
Green on Supply for the digital inputs is present and is > around 17 V DC.
Flashing green Supply for the digital inputs is not present or is < around 17 V DC.
FS Red Diagnostics for failure state
Off The safety application has a valid parameterization.
(Only applies if UI is on or flashing at the same time.)
Red on Hardware fault. Communication to the higher-level controller is disabled.
The module has entered the safe state (failure state).
Flashing red The module is not parameterized.

106887_en_01 PHOENIX CONTACT 19

AXL F SSDI8/4 1F

Table 2-1 Overview of diagnostics LEDs [...]

Des. Color State Description
P Green Diagnostics for safe communication protocol
Off No safe communication.
Green on Safe communication is running without errors.
Flashing green Safe communication is running. The SafetyBridge system is requesting an
acknowledgment.
CM Red Startup mode
Off SafetyBridge mode.
Red on Startup mode.
 WARNING: In startup mode, the device is in standard operation.
Startup mode: see Section 8.1.1 “Startup mode” on page 68.
SD Yellow Acknowledgment request
Off No diagnostic message present that needs to be acknowledged.
Yellow on A diagnostic message is present that needs to be acknowledged for safe
digital input errors, supply voltage errors or general errors.
Acknowledgment: see Section 9.2 “Acknowledging an error” on page 71.
00 - 07 Green Status of each input from 0 - 7
Off Input at logic “0”.
Green on Input at logic “1”.

20 PHOENIX CONTACT 106887_en_01

 Product description

2.8 Safe state

The safe state for the module is the transmission of the value “0” in the image of the inputs
to the logic module.
The safe state can be entered in the following cases:
1. Operating state
2. Error detection in I/O devices
3. Device errors
4. Parameterization errors
5. Error detection during safe communication

2.8.1 Operating state

In the operating state, the inputs can enter states “1” or “0”. State “0” is the safe state.

2.8.2 Error detection in I/O devices

Inputs If an error is detected at an input, the safe state is set at this input and a “0” is represented
in the process image of the input (“0” = safe state).

Operating time in the error

state

WARNING: Loss of the safe state in the failure state

In the failure state, internal module tests are no longer run and it is possible that the safe
state may be exited due to an accumulation of errors.
• If the module enters an error state, assess, acknowledge or remove the error within
72 hours.
Depending on the parameterization, the following errors can be detected at inputs:
– Short circuit
– Cross-circuit
– Overload/short circuit of the clock outputs
The diagnostic message is transmitted to the logic module: see Section 9 “Errors:
messages and removal” on page 71. Information on which errors occur and when: see
Section 7 “Connection examples for safe inputs” on page 41.

106887_en_01 PHOENIX CONTACT 21

AXL F SSDI8/4 1F

2.8.3 Device errors

Device errors can stop safe communication.

Inputs If a hardware fault in the internal circuit is detected at an input, all module inputs enter the
safe state. The value “0” is represented in the process image of the inputs (“0” = safe state).
The diagnostic message is transmitted to the logic module: see Section 9 “Errors:
messages and removal” on page 71.

Failure state: serious Serious errors that can result in the loss of or adversely affect the safety function cause the
errors entire module to enter the safe state. The FS LED on the module is permanently on. The
failure state can only be exited by means of a power up.

The following serious errors result in the safe state:

– Serious hardware faults in the internal circuit
– User errors
– Module overload
– Module overheating
– Incorrect supply
The diagnostic message is transmitted to the logic module: see Section 9 “Errors:
messages and removal” on page 71.

WARNING: Loss of safety function

Sequential errors can result in the loss of the safety function.
• In the event of a device error, the module should be completely disconnected from the
power supply and replaced so as to prevent sequential errors.

2.8.4 Parameterization errors

The module switches to the safe state following parameterization errors. The FS LED on the
module flashes.
In the event of faulty parameterization, a diagnostic message is transmitted to the logic
module: see Section 9 “Errors: messages and removal” on page 71.

22 PHOENIX CONTACT 106887_en_01

 Product description

2.9 Process data words

The module occupies four words in the Axioline F system.

Access the process data words via the “Operate” function block.

2.10 Programming data/configuration data

Phoenix Contact provides device description files for various control systems.

The programming data/configuration data is defined in the device description (FDCML,

GSD, GSDML, etc.) according to the bus or network used.

106887_en_01 PHOENIX CONTACT 23

AXL F SSDI8/4 1F

24 PHOENIX CONTACT 106887_en_01

 Integration of the Axioline F local bus

3 Integration of the Axioline F local bus

The module is integrated for operation in an Axioline F station.

More detailed information on the structure of an Axioline F station: see

UM EN AXL F SYS INST user manual.

3.1 Supply voltage of the module logic

The supply voltage for the module logic is generated in the bus coupler and led to the
Axioline F module via the bus base module.

WARNING: Loss of safety function

The use of unsuitable power supplies can result in the loss of the safety function.
• Only use power supplies according to EN 50178/VDE 0160 (PELV) for the voltage
supply at the bus coupler.
• Observe the general safety notes: see Section 1.2 “Electrical safety” on page 10.
Technical data for the supply voltage: see Section “Supply voltage UBUS (logic)” on
page 81.
The current carrying capacity for supply voltage UBUS depends on the bus coupler used.
• Observe the technical data and information in the documentation for the bus coupler.

3.2 Supply voltage UI

WARNING: Loss of safety function

The use of unsuitable power supplies can result in the loss of the safety function.
• Observe the general safety notes: see Section 1.2 “Electrical safety” on page 10.

Supply voltage UI supplies the input circuits, the clock outputs, and the switching elements
on the I/O side. Technical data for supply voltage UI: see “Supply voltage UI (sensors, clock
outputs, I/O)” on page 81.

106887_en_01 PHOENIX CONTACT 25

AXL F SSDI8/4 1F

The maximum current carrying capacity via the UI connector is 8 A.

NOTE: Module damage

Parallel protection against polarity reversal is only implemented in the module for a limited
period. The following measures must be taken to prevent damage to the module:
• Due to the maximum current carrying capacity of 8 A, protect power supply UI
externally with an 8 AT fuse.
• Only use PELV power supply units with at least four times the nominal tripping current,
as this is the only way to ensure tripping times of less than 300 ms.
The supply of supply voltage UI should feature a connection to functional earth ground
according to EN 60204-1.
UBK for supply at a bus coupler
or a power terminal
24 V DC external fuse
(PELV)
230 V + UI for supply at the Axioline F module
-
24 V

GND for supply at a bus coupler

or a power terminal
105738B000_en

Figure 3-1 Supply UI with connection to functional earth ground according to EN

60204-1

Observe the information regarding the behavior of the module in the event of an error at
supply voltage UI: see Section 9 “Errors: messages and removal” on page 71.

3.3 DC distribution network according to

IEC 61326-3-1

NOTE: Damage to module electronics

A surge voltage will damage the module electronics.
• Do not use a DC distribution network.
A DC distribution network is a DC power supply network which supplies a complete
industrial hall with DC voltage and to which any device is connected. A typical system or
machine distribution is not a DC distribution network. For devices that are intended for a
typical system or machine distribution, the DC connections are viewed and tested as I/O
signals according to IEC 61326-3-1.

26 PHOENIX CONTACT 106887_en_01

 Integration of the Axioline F local bus

3.4 Terminal point assignment

a1 00 07
a1 00 01 02 03 04 05 06 07

a2 10 17
a2 10 11 12 13 14 15 16 17

b1 20 27
b1 20 21 22 23 24 25 26 27

b2 30 37
b2 30 31 32 33 34 35 36 37

Figure 3-2 Terminal point assignment

The Axioline F connectors are supplied with the module. They are color coded and marked
for connection.

Only use the connectors supplied with the module.

The following applies for the tables below:

– All inputs are safe digital inputs
– 0 V (GND): common ground of inputs and clock outputs
– FE: common functional earth ground
– T1: clock output 1
– T2: clock output 2

Table 3-1 Terminal point assignment of the voltage connection

Terminal point Color Assignment

a1, a2 Red 24 V DC (UI) UI: supply of the digital inputs
(internally connected)
b1, b2 Blue GND Reference potential of the
supply voltage (internally
connected)

106887_en_01 PHOENIX CONTACT 27

AXL F SSDI8/4 1F

Table 3-2 Terminal point assignment of the I/O connection

Color Connector 1 (blue) Connector 2 (red) Connector 3 Connector 4
(white) (green)
Terminal point 00 01 02 03 04 05 06 07
Orange
Function IN0_CH1 IN0_CH2 IN1_CH1 IN1_CH2 IN2_CH1 IN2_CH2 IN3_CH1 IN3_CH2
Terminal point 10 11 12 13 14 15 16 17
Red
Function Clock T1 Clock T2 Clock T1 Clock T2 Clock T1 Clock T2 Clock T1 Clock T2
Terminal point 20 21 22 23 24 25 26 27
Blue
Function GND GND GND GND GND GND GND GND
Terminal point 30 31 32 33 34 35 36 37
Green
Function FE

WARNING: Loss of safety function

Parasitic voltages can result in the loss of the safety function.
• Wire sensors that require a GND to the corresponding slot for 0 V (GND).

28 PHOENIX CONTACT 106887_en_01

 Assembly, removal, and electrical installation

4 Assembly, removal, and electrical installation

4.1 Assembly and removal

4.1.1 Unpacking the module

.

NOTE: Electrostatic discharge

The module contains components that can be damaged or destroyed by electrostatic
discharge.
• When handling the module, observe the safety precautions against electrostatic
discharge (ESD) according to EN 61340-5-1 and IEC 61340-5-1.
• Read the package slip and follow the instructions.
The module may only be installed and removed by qualified personnel.

4.1.2 Preparation and assembly

WARNING: Unintentional machine startup

Make sure that the power to the system is disconnected before carrying out assembly and
removal work as this could cause unintentional machine startup.
• Before assembling or removing the module, disconnect the power to the module and
the entire Axioline F station and make sure that the system cannot be switched on
again.
• Make sure the entire system is reassembled before switching the power back on and
that neither the station nor the system poses a hazard.
Observe the diagnostics indicators and any diagnostic messages.
• Mount the module on a 35 mm DIN rail in a control cabinet or junction box protected
from dust and humidity (IP54 or higher).
• Secure the control cabinet/junction box to prevent unauthorized opening.
• Only connect the cables using the supplied Axioline F connectors.

106887_en_01 PHOENIX CONTACT 29

AXL F SSDI8/4 1F

4.1.3 Setting the DIP switch

A DIP switch is located on the top of the module.

CM| Island | Satellite

off
S1 on
11 9 7 5 3 1
10 8 6 4 2 0

Figure 4-1 DIP switch

12-pos. DIP switch: Set the SafetyBridge address and the operating mode via the 12-pos. DIP switch.
address and operating
mode

Overview of the switch

positions
Table 4-1 Switch position

Operatin Reserved SafetyBridge address

g mode
CM Island number Satellite number
11 10 9 8 7 6 5 4 3 2 1 0
off/on on 1dec to 31dec 1dec to 16dec

Switch 0 to 9: SafetyBridge address

Switch 10: Reserved Always on
Switch 11: Operating off = SafetyBridge mode
mode on = startup mode

Position 10 of the 12-pos. DIP switch is reserved and must always be in the “on” position.
Otherwise, the module responds with a failure state.

Setting the address • Remove the marking field and set the address in the switch below it.
• Reattach the marking field to the module.

The set address is only applied on power up. If the address is adjusted during operation,
the module responds with a failure state.

30 PHOENIX CONTACT 106887_en_01

 Assembly, removal, and electrical installation

4.1.4 Mounting and removing modules

Mounting the bus base

module
• Place all bus base modules required for the
station on the DIN rail (A).
• Push the bus base modules into the
connection for the bus coupler or the

A previous bus base module (B).

Snapping on and
Snap on
removing the electronics
module • Place the electronics module vertically on
the corresponding bus base module on the
DIN rail until it snaps into place with a click.
Make sure that the device connector for the
bus base connection is situated above the
corresponding socket on the bus base
module.

Remove
• Before removing the module, remove all

A •
connectors.
Insert a suitable tool (e.g., bladed
screwdriver) into the upper and lower snap-

A B
on mechanisms (base latches) of the
module one after the other to release it (A).
• Remove the module perpendicular to the
DIN rail (B).

106887_en_01 PHOENIX CONTACT 31

AXL F SSDI8/4 1F

Inserting and removing

Insert
the connector
• Place the connector vertically into its
position.
Note the color markings of the
connectors/slots.
Assignment from left to right:
blue, red, white, green.
• Press firmly on the connector. Make sure
that the locking latch snaps in.

Remove

C
A
• Release the locking latch (A).
• Tilt the connector upwards slightly (B).
• Remove the connector from the module (C).

B
A

32 PHOENIX CONTACT 106887_en_01

 Assembly, removal, and electrical installation

4.2 Electrical installation

WARNING: Electric shock/unintentional machine startup

Make sure that the power to the system is disconnected before carrying out installation
work as this could cause a hazardous electric shock as well as unintentional machine
startup.
• Prior to installation work, disconnect the power to the system and make sure that it
cannot be switched on again unintentionally.
• Make sure all work is completed before switching the power back on and that neither
the station nor the system poses a hazard.
Observe the diagnostics indicators and any diagnostic messages.

4.2.1 Electrical installation of the Axioline F station

Electrical installation of the Axioline F station includes the following:

– Connection to the higher-level bus system
– Connecting the supply voltages for the Axioline F station
• Carry out electrical installation for the Axioline F station according to the following user
manuals:
– Axioline F: system and installation user manual, UM EN AXL F SYS INST
– Axioline F system manual for your bus system

• Observe the additional information in the documentation for the bus coupler.

4.2.2 Electrical installation of the module

Observe the general safety notes: see Section 1.2 “Electrical safety” on page 10.

WARNING: Loss of safety function/damage to equipment

Improper installation, e.g., due to the mismatching or polarity reversal of connections, can
result in the loss of the safety function as well as damage to equipment.
• Take measures to prevent the mismatching or polarity reversal of connections.
• Prevent the tampering of connections.
The supply voltage for the module electronics is fed to the bus coupler. From this, the supply
voltage of the module logic is provided via the bus base module. The supply voltage of the
input circuits, clock outputs, and I/O devices is fed directly to the module.
The sensors are connected via Axioline F connectors.
• Wire the connectors according to your application: see Section 3.4 “Terminal point
assignment” on page 27.

106887_en_01 PHOENIX CONTACT 33

AXL F SSDI8/4 1F

34 PHOENIX CONTACT 106887_en_01

 Parameterization of the module

5 Parameterization of the module

5.1 Parameterization in a SafetyBridge system

Parameterization includes the following:

– Assigning the SafetyBridge address
– Parameterizing inputs

The communication address configured in the controller project must match the address
set on the device.
The settings on the device take effect after a power up.

SafetyBridge address The SafetyBridge address is a unique ID for the safety module in the SafetyBridge structure.
It is assigned in the configuration software for the assigned logic module.
The address of the connected satellites (here: AXL F SSDI8/4 1F) is based on the island
number of the logic module and the position in the bus navigator of the configuration
software.
• Set the address of the safety module via the DIP switch (see see “Setting the DIP
switch” on page 30).

For more detailed information on the SafetyBridge address, please refer to the
documentation for the logic module used.

Parameterization of the The parameterization of the safe inputs determines the behavior of the module and
inputs and clock outputs influences the safety integrity that can be achieved.
The controller automatically writes the parameterization created in the configuration
software to the module on every power up, reset or deactivation/activation of the “Operate”
function block.
The following conditions must be met:
– Supply voltage is present
– Local bus is in the RUN state
– Communication connection has been established between the controller and the
module
The module cannot be operated if it is not parameterized. The FS LED flashes.
The module is ready to operate if the parameters for all inputs are valid and transmitted
without errors. Valid input data is only read in this state. In every other state, the safe state
is transmitted for each input (“0” in the process image of the inputs).
If errors are detected during parameterization, the parameterization data is not applied. The
FS LED flashes to indicate that the parameterization is invalid.
In addition, the error is reported to the controller.
• In this case, check and correct the settings.
Information on error messages and troubleshooting: see Section 9 “Errors: messages and
removal” on page 71.

106887_en_01 PHOENIX CONTACT 35

AXL F SSDI8/4 1F

5.2 Parameterization of the safe inputs

The individual input pairs of a module can be parameterized differently, which means that
different safety integrity levels (SIL, SILCL, Cat., PL) can be achieved.

Two-channel The following fixed assignment applies for two-channel operation:

– IN0_Ch1 to IN0_Ch2
– IN1_Ch1 to IN1_Ch2
– IN2_Ch1 to IN2_Ch2
– IN3_Ch1 to IN3_Ch2
The input information of both inputs is mapped to one bit. The unused bits are always set
to “0”.

Single-channel For single-channel assignment, the inputs can be parameterized so that they operate
independently of one another.

Parameterization The safe inputs are parameterized in pairs for each connector. Table 5-1 describes the
parameterization options.

Table 5-1 Parameterization of each input pair

Parameterization Value range Comment
Assignment – Not assigned Parameterize the input pairs in pairs.
– Assigned For unused inputs, the data is filled with “0”.
– Both single-channel In two-channel operation, the inputs have a fixed
assignment to one another.
– Two-channel equivalent
– Two-channel non-
equivalent
Filter time (tFilter) – 1.5 ms The filter time is used to suppress interference for the input
– 3 ms signals.
– 5 ms Select the filter time so that the duration of the input signal is
greater than the filter time.
– 15 ms
 WARNING: The filter time affects the response time of
the safety function.
Symmetry – Disabled Parameterization is only active if the input is parameterized
– 100 ms for two-channel operation.
– 1s See also see “Symmetry/ start inhibit” on page 37.
– 5s
Start inhibit due to – Disabled Disabled: only a diagnostic message is generated in the
symmetry violation – Enabled event of symmetry violation.
Enabled: a diagnostic message is generated in the event of
symmetry violation. In addition, the affected input is set to
the safe state.
Cross-circuit detection – No cross-circuit monitoring As soon as cross-circuit monitoring is enabled for an
– Cross-circuit monitoring assigned input pair, clock outputs T1 and T2 are clocked.
– INx_CH1 -> T1 Otherwise the clock outputs are enabled without clocking.
– INx_CH2 -> T2
The default values are shown in bold.

36 PHOENIX CONTACT 106887_en_01

 Parameterization of the module

Symmetry/ Symmetry monitoring can be used to monitor the contact wear of the switch. Symmetry
start inhibit monitoring checks the extent to which the related (filtered) inputs enter another state
simultaneously. Symmetry is violated if the inputs indicate different states for a time greater
than the value parameterized for “symmetry”. This applies for positive and negative edges.
Key for the following diagrams:

S Set time for symmetry monitoring

Diag Diagnostics
Bit Transmitted state of the inputs
Q Acknowledgment of the diagnostic message. After acknowledging the diagnostic
message, the current state is read in.

For non-equivalent parameterization, a negated signal is present at input IN0_Ch2 as

illustrated.

IN0_Ch1 1 IN0_Ch1 1
0 0
IN0_Ch2 1 IN0_Ch2 1
0 0
Bit 1 Bit 1
0 0
Diag 1 Diag 1
0 0
S S 76020007
Figure 5-1 Example for a signal change in the parameterized time for symmetry
monitoring

IN0_Ch1 1 IN0_Ch1 1
0 0
IN0_Ch2 1 IN0_Ch2 1
0 0
Bit 1 Bit 1
0 0
Diag 1 Diag 1
0 0
S S 76020008
Figure 5-2 Example for a signal change outside the parameterized time for symmetry
monitoring, start inhibit due to symmetry violation is disabled

106887_en_01 PHOENIX CONTACT 37

AXL F SSDI8/4 1F

IN0_Ch1 1
0
IN0_Ch2 1
0
Bit 1
0
Diag 1
0
Q1
0
S S S S S S 76020009

Figure 5-3 Example for a signal change outside the parameterized time for symmetry
monitoring, start inhibit due to symmetry violation is enabled

After acknowledging the diagnostic message, the current state at the input is immediately
transmitted to the logic module.
• If required, implement a startup inhibit in the application program following error
acknowledgment.
See also see “Errors: messages and removal” on page 71.

A symmetry violation can also be triggered by a cross circuit: see Section 7 “Connection
examples for safe inputs” on page 41.

Processing time of input The processing time of input tIN in the event of a safety demand consists of the
tIN in the event of a safety parameterized filter time tFilter and the firmware runtime tFW:
demand
tIN = tFilter + tFW

Where:

tIN Processing time of the input

tFilter Parameterized filter time
tFW Firmware runtime: 1 ms

38 PHOENIX CONTACT 106887_en_01

 Duration of a safety demand

6 Duration of a safety demand

The duration of a safety demand must be greater than the processing time of the
corresponding input tIN: see “Processing time of input tIN in the event of a safety demand”
on page 38.
If the safety module detects a safety demand after the processing time of the input tIN has
elapsed, when using SafetyBridge this time is extended by the module until the logic module
has received the safety demand.

106887_en_01 PHOENIX CONTACT 39

AXL F SSDI8/4 1F

40 PHOENIX CONTACT 106887_en_01

 Connection examples for safe inputs

7 Connection examples for safe inputs

7.1 Explanation of the examples

WARNING: Loss of safety function

Improperly executed applications can result in the loss of the safety function.
• Observe the information to achieve the specified category: see Section 7.2
“Measures to achieve a specific safety integrity” on page 42.
• Make sure that the sensor has appropriate diagnostic coverage and an appropriate
MTTFd to achieve the specified PL.
For applications according to PL d, high diagnostic coverage (> 99%) is
recommended, however medium diagnostic coverage (90% to 99%) and a medium
MTTFd are required at the very least.
For applications according to PL e, high diagnostic coverage (> 99%) and a high
MTTFd are required.
• Use sensors that can achieve the required safety integrity.

• For the examples, please also observe the measures specified in the tables as well as
standards IEC 61508, EN 62061, and EN ISO 13849-1 to achieve the specified
SIL/SILCL/Cat./PL.

The above notes apply in general for all of the connection examples in this section.
• Also observe the notes listed in the individual connection examples.
If the settings do not contradict one another, the inputs of a module can achieve different
safety integrity levels (SIL, SILCL, Cat., PL) simultaneously.
The examples only describe the options for the electrical connection of sensors to the safe
inputs.
Should you have any questions regarding your applications, please contact the
Phoenix Contact safety hotline: see Section 1.8 “Safety hotline” on page 12.
The following are specified for each example:
– Basic specifications
The table specifies the main data for the example.
– Device diagnostics and behavior of the module in the event of an error
Diagnostic capability depends on the parameterization.
If a message is generated for an error, the message is specified in the tables.
Information on the error code as well as possible solutions and information as to
whether the error message must be acknowledged: see Section 9 “Errors: messages
and removal” on page 71.
The symmetry violation diagnostic message is only displayed if it was not disabled
during parameterization of the affected input.
– Typical parameterization
The table illustrates an example of all the parameters for the specified assignment.

106887_en_01 PHOENIX CONTACT 41

AXL F SSDI8/4 1F

Key for tables in this section:

Representation Meaning
Bold Mandatory setting
Normal Typical setting, another setting is possible depending on the
application
– Not evaluated

Errors (cross-circuits, short circuits) which can be prevented by correct installation (e.g.,
protected cable installation, isolated cable installation, double insulation, use of ferrules) are
not described in the tables.
Only errors between inputs, which are on the same connector, are described. For example,
in the event of correct installation, cross-circuits with inputs/outputs of other connectors
cannot occur.

7.2 Measures to achieve a specific safety integrity

The safety integrity (SIL, SILCL, category, and performance level) that can be achieved is
specified for each connection example.

SIL/SILCL

Use the standard to determine the probability of failure in your application according to
IEC 61508 (SIL) and EN 62061 (SILCL).

Table 7-1 PFD and PFH depending on the SIL/SILCL

Safety integrity PFD PFH

-2 1% of 10-6
SIL 2/SILCL 2 1% of 10
SIL 3/SILCL 3 1% of 10-3 1% of 10-7

Performance level
Use standard EN ISO 13849-1 to determine the performance level.

42 PHOENIX CONTACT 106887_en_01

 Connection examples for safe inputs

Category The categories are achieved with the following measures:

Measure Cat. 2 Cat. 3 Cat. 4

Use proven and basic safety principles according to x x x
EN ISO 13849-2.
Use qualified sensors: see “Requirements for x x x
sensors/controlling devices” on page 15.
Please note that mechanical failure of the switching device can x x x
result in the loss of the safety function.
Prevent (e.g., by means of protection, redundancy, positive x x
opening operation) contacts from failing to open (e.g., due to
welding or mechanical failure) when a switch is actuated.
Please note that a single error can result in the loss of the safety x
function between tests.
Make sure that the external wiring is tested by the machine x
controller on machine startup and at suitable intervals. This test
must detect the loss of the safety function.
Please take into consideration errors with a common cause. x x
Please note that all errors that cannot be detected can result in x x
the loss of the safety function. Take measures to prevent these
errors (e.g., protected cable installation or double insulation).
Observe the notes in the following tables.
Make sure that a single error does not result in the loss of the x
safety function.
If single-channel sensors are not available for this category, x
use two-channel sensors.
An accumulation of errors must not result in the loss of the x
safety function. Following the third error, evaluation can be
aborted if the probability of further errors occurring is low.

106887_en_01 PHOENIX CONTACT 43

AXL F SSDI8/4 1F

7.3 Single-channel assignment of safe inputs

For the single-channel assignment of safe inputs, the inputs operate independently of one
another. The assignment of each input signal to the clock output cannot be freely selected.

7.3.1 Notes

Please observe the following notes:

Cross-circuit
• Please note that cross-circuits with other inputs can only be detected if cross-circuit
monitoring is enabled.
The cross-circuit error results in the transmission of the safe state in the process data image
of the affected inputs.
• Remove the error and then acknowledge the message.
• Observe the maximum failure detection time of 64 ms.
If a “1” signal is present at the input and an error occurs, a maximum of 64 ms elapses until
the error is detected. During this time, another “1” can be transmitted, even in the event of
an error.
During the failure detection time (64 ms, maximum), the error can cause the state to change
unexpectedly from “0” to “1”.
• Make sure that the system cannot be restarted unintentionally as a result of this change
in state.
• Please note that the processing time for the input tIN increases by up to 64 ms in the
event of an error.
For the power supply for single-channel assignment, use the relevant clock output or an
external power supply (external +24 V or OSSD).

State evaluation
The module evaluates the states of the inputs and transmits the result to the logic module.
The following values are transmitted in the process data image of a safe input:
– “0” if a “0” signal is present at the input or an error has been detected
– “1” if a “1” signal is present at the input and no error has been detected

7.3.2 Cross-circuit monitoring enabled

If an input pair is parameterized as single-channel with cross-circuit monitoring, the fixed

assignment is as follows:
– INx_Ch1 is permanently assigned to clock output T1
– INx_Ch2 is permanently assigned to clock output T2

S1
IN1_Ch1 S1 Safety switch
T1

Figure 7-1 Single-channel assignment of inputs

44 PHOENIX CONTACT 106887_en_01

 Connection examples for safe inputs

Basic specifications

Sensor Single-channel
Sensor supply Internally through clock output T1 (clocked) or T2 (clocked)
Achievable SIL 2/SILCL 2/Cat. 3/PL d
safety integrity

Device diagnostics and behavior of the module in the event of an error

Table 7-2 Single-channel: supply through T1 (clocked) or T2 (clocked)

Error type Detection Diagnostics Loss of Comment
SF1
Error in the sensor
A contact fails to open No None Yes The error cannot be detected and results in the loss of the safety
function.
A contact fails to close No None No The error cannot be detected.
Other errors Please take into consideration errors that can occur in the sensor.
(depending on the sensor)
Error in the wiring
Interrupt
Input Yes None No – Behavior when the input is in state “1”:
(cable interrupt between clock The error is detected as a change in state from “1” to “0”. An
output and sensor or between unexpected change from “0” to “1” is possible.
sensor and input) Make sure that this change in state cannot restart the system
unintentionally.
– Behavior when the input is in state “0”:
Please note that if this error causes the safety switch to be switched
on again, this can result in delayed transmission of state “1” in the
process data image of the inputs.
Cross-circuit
Input to input No None Yes The error cannot be detected and results in the loss of the safety
function, as the safety switch is bypassed.
If the inputs are assigned to different clock outputs, this error is
detected as a cross-circuit after 64 ms.
Input to assigned clock output No None Yes The error cannot be detected and results in the loss of the safety
function, as the safety switch is bypassed.
Input to non-assigned clock Yes Cross-circuit No see “Cross-circuit” on page 44
output
Clock output to clock output Yes if Cross-circuit No The error is only detected in state “1” of the input.
state “1”
Short circuit
Input to ground Yes None No The error is only detected as a change in state from “1” to “0” in state
“1” of the input. An unexpected change from “0” to “1” is possible.
Make sure that this change in state cannot restart the system
unintentionally.
Clock output to ground Yes Short circuit No The affected clock output is disabled.
1 SF = safety function

106887_en_01 PHOENIX CONTACT 45

AXL F SSDI8/4 1F

Typical parameterization

Parameterization Parameterized as/value range Comment

Input xx channel 1/channel 2
Assignment Both single-channel
Filter time (tFilter) 3 ms Application-specific
Symmetry Disabled
Start inhibit due to symmetry Disabled
violation
Cross-circuit monitoring Cross-circuit monitoring

7.3.3 Cross-circuit monitoring disabled, supply through T1

S1
IN1_Ch1 S1 Safety switch
T1 Supply through T1
T1 (T2)

Figure 7-2 Single-channel assignment of inputs: supply through T1

S1
IN1_Ch1 S1 Safety switch
+24 V Supply through external 24 V
+24 V

Figure 7-3 Single-channel assignment of inputs: external supply

Basic specifications

Sensor Single-channel switch

Sensor supply – Internally through clock output T1 or T2; cross-circuit monitoring disabled
– External (24 V)
Achievable SIL 2/SILCL 2/Cat. 2/PL d
safety integrity

WARNING: Loss of safety function

Cross-circuits can result in the loss of the safety function.
• Prevent cross-circuits to achieve the specified PL.

46 PHOENIX CONTACT 106887_en_01

 Connection examples for safe inputs

Device diagnostics and behavior of the module in the event of an error

Table 7-3 Single-channel without cross-circuit monitoring: supply through T1/T2,
external supply or OSSD
Error type Detection Diagnostics Loss of Comment
SF1
Error in the sensor
A contact fails to open No None Yes The error cannot be detected and results in the loss of the safety
function.
A contact fails to close No None No The error cannot be detected.
Other errors Please take into consideration errors that can occur in the sensor.
(depending on the sensor)
Error in the wiring
Interrupt
Input Yes None No – Behavior when the input is in state “1”:
(cable interrupt between clock The error is detected as a change in state from “1” to “0”. An
output and sensor or between unexpected change from “0” to “1” is possible.
sensor and input) Make sure that this change in state cannot restart the system
unintentionally.
– Behavior when the input is in state “0”:
Please note that if this error causes the safety switch to be switched
on again, this can result in delayed transmission of state “1” in the
process data image of the inputs.
Cross-circuit
Input to input No None Yes The error cannot be detected and results in the loss of the safety
function, as the safety switch is bypassed.
Input to clock output No None Yes The error cannot be detected and results in the loss of the safety
function, as the safety switch is bypassed.
Short circuit
Input to external 24 V No None Yes The error cannot be detected and results in the loss of the safety
function, as the safety switch is bypassed.
Input to ground Yes if None No The error is only detected as a change in state from “1” to “0” in state
state “1” “1” of the input. An unexpected change from “0” to “1” is possible.
Make sure that this change in state cannot restart the system
unintentionally.
Clock output to external 24 V No None No The error cannot be detected as clocking is disabled.
Clock output to ground Yes Short circuit No The affected clock output is disabled.
External 24 V to ground Yes None No The error is only detected as a change in state from “1” to “0” in state
“1” of the input. An unexpected change from “0” to “1” is possible.
Make sure that this change in state cannot restart the system
unintentionally.
1
SF = safety function

106887_en_01 PHOENIX CONTACT 47

AXL F SSDI8/4 1F

Typical parameterization

Parameterization Parameterized as/value range Comment

Input xx channel 1/channel 2
Assignment Both single-channel
Filter time (tFilter) 3 ms Application-specific
Symmetry Disabled
Start inhibit due to symmetry Disabled
violation
Cross-circuit monitoring No cross-circuit monitoring

7.3.4 Supply through OSSD

OSSD
+24 V

IN1_Ch1

GND

Figure 7-4 Single-channel assignment of inputs: external supply (OSSD)

WARNING: Loss of safety function

Parasitic voltages can result in the loss of the safety function.
• Connect the sensor ground directly to terminal point GND of the module. An external
ground may not be used.

Basic specifications

Sensor Single-channel OSSD output (with internal testing)

Sensor supply External (OSSD sensor)
Achievable SIL 2/SILCL 2/Cat. 2/PL d
safety integrity

WARNING: Loss of safety function

Cross-circuits can result in the loss of the safety function.
• Prevent cross-circuits to achieve the specified PL.

48 PHOENIX CONTACT 106887_en_01

 Connection examples for safe inputs

Device diagnostics and behavior of the module in the event of an error

Table 7-4 Single-channel: supply through OSSD
Error type Detection Diagnostics Loss of Comment
SF1
Error in the sensor
(depending on the sensor) Please take into consideration errors that can occur in the sensor.
Error in the wiring
Interrupt
Input Yes None No – Behavior when the input is in state “1”:
(cable interrupt between sensor The error is detected as a change in state from “1” to “0”. An
and input) unexpected change from “0” to “1” is possible.
Make sure that this change in state cannot restart the system
unintentionally.
– Behavior when the input is in state “0”:
Please note that if this error causes the safety switch to be switched
on again, this can result in delayed transmission of state “1” in the
process data image of the inputs.
Input No None No The sensor must detect the error.
(cable interrupt between sensor The sensor must ensure that the safe state is entered in the event of
and GND) an error.
Cross-circuit
Input to input No None Yes The error cannot be detected and results in the loss of the safety
function, as the safety switch is bypassed.
Input to clock output No None Yes The error cannot be detected and results in the loss of the safety
function, as the safety switch is bypassed.
Short circuit
Input to external 24 V No None Yes The error cannot be detected and results in the loss of the safety
function, as the safety switch is bypassed.
Input to ground Yes if None No The error is only detected as a change in state from “1” to “0” in state
state “1” “1” of the input. An unexpected change from “0” to “1” is possible.
Make sure that this change in state cannot restart the system
unintentionally.
Clock output to external 24 V No None No The error cannot be detected as clocking is disabled.
Clock output to ground Yes Short circuit No The affected clock output is disabled.
External 24 V to ground Yes None No The error is only detected as a change in state from “1” to “0” in state
“1” of the input. An unexpected change from “0” to “1” is possible.
Make sure that this change in state cannot restart the system
unintentionally.
1 SF = safety function

106887_en_01 PHOENIX CONTACT 49

AXL F SSDI8/4 1F

Typical parameterization

Parameterization Parameterized as/value range Comment

Input xx channel 1/channel 2
Assignment Both single-channel
Filter time (tFilter) 3 ms Application-specific
Symmetry Disabled
Start inhibit due to symmetry Disabled
violation
Cross-circuit monitoring No cross-circuit monitoring

Set the filter time for the input to a value greater than the width of the test pulse for the
OSSD sensor.
The input must be parameterized without cross-circuit monitoring.

7.4 Two-channel equivalent assignment of safe inputs

For two-channel assignment of the inputs, two adjacent inputs of the same connector are
always used. This assignment cannot be parameterized: see “Two-channel” on page 36.
For two-channel equivalent assignment, the state changes from “0” to “1” only when both
inputs change state from “0” to “1”. If symmetry monitoring is enabled and the state at both
inputs does not change within the parameterized time, a diagnostic message is generated.
The input is active when the state of the signal is “1”.

Please note that if a delayed change in state at one of the two inputs causes the safety
switch to be switched on again, this can result in delayed transmission of state “1” in the
process data image of the inputs.

50 PHOENIX CONTACT 106887_en_01

 Connection examples for safe inputs

Example of correct and incorrect signal change

IN0_Ch1 1
0
IN0_Ch2 1
0
IN0 (Ch1/Ch2) 1
0
Figure 7-5 Correct signal change

IN0_Ch1 1
0
IN0_Ch2 1
0
IN0 (Ch1/Ch2) 1
0
Figure 7-6 Error during signal change

Key for Figure 7-5 and Figure 7-6

IN0_Ch1 Signal sequence at input 0 channel 1

IN0_Ch2 Signal sequence at input 0 channel 2
IN0 Safety-related signal for two-channel input 0, channel 1 and channel 2 at
(Ch1/Ch2) the logic module
In Figure 7-6, the condition that both signals must be in state “0” before the change in state
from “0” to “1” is not met. In this case, the diagnostic message is generated.

State evaluation
The module evaluates the states of the inputs and transmits the result to the logic module.
The following values are transmitted in the process data image of the safe inputs:
– “0” if a “0” signal is present at at least one of the two inputs or an error has been
detected
– “1” if a “1” signal is present at both inputs and no error has been detected and the
conditions are met for a change in state according to Figure 7-6

106887_en_01 PHOENIX CONTACT 51

AXL F SSDI8/4 1F

7.4.1 Notes on errors

Please observe the following notes on cross-circuit and symmetry violation:

Cross-circuit
The cross-circuit error results in the transmission of the safe state in the process data
image of the affected inputs.
• Remove the error and then acknowledge the message.
Acknowledging the diagnostic message deletes the message and activates the input. The
states at the input are detected immediately.
• In the safe application program, make sure that the system cannot be restarted
unintentionally after acknowledging the diagnostic message.
• Observe the maximum failure detection time of 64 ms.
Exceptions in the failure detection time are indicated in the tables below.
If a “1” signal is present at the input and an error occurs, a maximum of 64 ms elapses until
the error is detected. During this time, another “1” can be transmitted, even in the event of
an error.
During the failure detection time, the error can cause the state to change unexpectedly from
“0” to “1”.
• Make sure that the system cannot be restarted unintentionally as a result of this change
in state.

Symmetry violation
– The symmetry violation diagnostic message is only displayed if it was not disabled
during parameterization of the affected input.
– Start inhibit due to symmetry violation disabled:
The symmetry violation message does not result in the transmission of the safe state:
see “Symmetry/ start inhibit” on page 37.
The message must be acknowledged. However, the current status of the inputs is
always displayed in the process data image of the inputs.
– Start inhibit due to symmetry violation enabled:
The symmetry violation message results in the transmission of the safe state: see
“Symmetry/ start inhibit” on page 37.
The message must be acknowledged. Following acknowledgment, the current status
of the inputs is displayed in the process data image of the inputs.
– The message can be used to monitor the wear of the safety switch.

52 PHOENIX CONTACT 106887_en_01

 Connection examples for safe inputs

7.4.2 Cross-circuit monitoring enabled, supply through T1 and

T2

Possible wiring versions:

IN1_Ch1 S1
S1, S2 Switching element
T1, T2 Supply through T1 and T2
T1
IN1_Ch2 S2

T2
Figure 7-7 Two-channel equivalent assignment of inputs,
supply through T1 and T2 (both clocked)

Basic specifications

Sensor Two-channel equivalent with cross-circuit monitoring

Sensor supply Internally through clock output T1 and T2 (both clocked)
Achievable SIL 3/SILCL 3/Cat. 4/PL e
safety integrity

Device diagnostics and behavior of the module in the event of an error

Observe the information to understand the change in state: see “Example of correct and
incorrect signal change” on page 51.

Table 7-5 Two-channel equivalent with cross-circuit monitoring: supply through T1 and T2
Error type Detection Diagnostics Loss of Comment
SF1
Error in the sensor
A contact fails to open Yes Symmetry No The error is detected on a change in state, as the state only changes
violation2 in one channel.
– Change in state from “1” to “0”:
The faulty input remains at “1”. A “0” is transmitted in the process data
image of the affected inputs.
– Change in state from “0” to “1”:
A “0” is transmitted in the process data image of the affected inputs,
as the faulty input was not previously set to state “0”.
A contact fails to close Yes Symmetry No On a change in state from “0” to “1”, a “0” is transmitted in the process
violation2 data image of the affected inputs, as only one channel reports this
change in state.
Other errors Please take into consideration errors that can occur in the sensor.
(depending on the sensor)
Error in the wiring
Interrupt
Input Yes Symmetry No The error is detected in state “1” or on a change in state from “0” to
(cable interrupt between clock violation2 “1”, as the state only changes in one channel.
output and sensor or between
sensor and input)
Cross-circuit
Input to input Yes Cross-circuit No The error is detected in state “1”

106887_en_01 PHOENIX CONTACT 53

AXL F SSDI8/4 1F

Table 7-5 Two-channel equivalent with cross-circuit monitoring: supply through T1 and T2 [...]
Error type Detection Diagnostics Loss of Comment
SF1
Input to assigned clock output Yes Symmetry No The error is detected on a change in state, as the state only changes
violation2 in one channel.
– Change in state from “1” to “0”:
The faulty input remains at “1”. A “0” is transmitted in the process data
image of the affected inputs.
– Change in state from “0” to “1”:
A “0” is transmitted in the process data image of the inputs, if the
faulty input was not previously set to state “0”.
Input to non-assigned clock Yes Cross-circuit No see “Cross-circuit” on page 52.
output
Clock output to clock output Yes Cross-circuit No The error is detected for inputs which are assigned to different clock
outputs.
Short circuit
Input to ground Yes Symmetry No The error is detected in state “1” or on a change in state from “0” to
violation2 “1”, as the state only changes in one channel.
Clock output to ground Yes Short circuit No The error is detected in state “1” or on a change in state from “0” to
“1”, as the state only changes in one channel.
The error is also detected as a short circuit of the clock output.
The affected clock output is disabled.
1
SF = safety function
2 Only applies when symmetry monitoring is active

Typical parameterization

Parameterization Parameterized as/value range Comment

Input xx channel 1/channel 2
Assignment Two-channel equivalent
Filter time (tFilter) 3 ms Application-specific
Symmetry 100 ms Application-specific
Start inhibit due to symmetry Enabled Application-specific
violation
Cross-circuit monitoring Cross-circuit monitoring

54 PHOENIX CONTACT 106887_en_01

 Connection examples for safe inputs

7.4.3 Cross-circuit monitoring disabled, supply through a clock

output or external supply

IN1_Ch1 S1 S1, S2 Two switching elements

T1 (T2) Supply through T1 or T2
IN1_Ch2 S2

T1 (T2)
Figure 7-8 Two-channel equivalent assignment of inputs,
supply through T1 (or T2), cross-circuit monitoring disabled

S1, S2 Two switching elements

S1
IN1_Ch1
+24 V External supply
S2
IN1_Ch2

+24 V

Figure 7-9 Two-channel equivalent assignment of inputs,

external supply, cross-circuit monitoring disabled

Basic specifications

Sensor Two-channel equivalent

Sensor supply Internally through clock output T1 (or T2) or externally
Achievable SIL 3/SILCL 3/Cat. 3/PL d
safety integrity

Observe the information to understand the change in state: see “Example of correct and
incorrect signal change” on page 51.

106887_en_01 PHOENIX CONTACT 55

AXL F SSDI8/4 1F

Device diagnostics and behavior of the module in the event of an error

Table 7-6 Two-channel equivalent, cross-circuit monitoring disabled: supply through a clock output or external supply
Error type Detection Diagnostics Loss of Comment
SF1
Error in the sensor
A contact fails to open Yes Symmetry No The error is detected on a change in state, as the state only changes
violation2 in one channel.
– Change in state from “1” to “0”:
The faulty input remains at “1”. A “0” is transmitted in the process data
image of the affected inputs.
– Change in state from “0” to “1”:
A “0” is transmitted in the process data image of the affected inputs,
as the faulty input was not previously set to state “0”.
A contact fails to close Yes Symmetry No On a change in state from “0” to “1”, a “0” is transmitted in the process
violation2 data image of the affected inputs, as only one channel reports this
change in state.
Other errors Please take into consideration all errors that can occur in the sensor.
(depending on the sensor)
Error in the wiring
Interrupt
Cable interrupt between clock Yes None No – Behavior when the input is in state “1”:
output or external supply and The error is detected as a change in state from “1” to “0”. An
sensor unexpected change from “0” to “1” is possible.
Make sure that this change in state cannot restart the system
unintentionally.
Cable interrupt between sensor Yes Symmetry No The error is detected in state “1” or on a change in state from “0” to “1”,
and input violation2 as the state only changes in one channel.
Cross-circuit
Input to input No None No An accumulation of errors can result in the loss of the safety function.
Input to clock output Yes Symmetry No The error is detected on a change in state, as the state only changes
violation2 in one channel.
– Change in state from “1” to “0”:
The faulty input remains at “1”. A “0” is transmitted in the process data
image of the affected inputs.
– Change in state from “0” to “1”:
A “0” is transmitted in the process data image of the inputs, if the faulty
input was not previously set to “0”.
Clock output to clock output No None No The error is not detected.
Short circuit
Input to external 24 V Yes Symmetry No The error is detected on a change in state, as the state only changes
violation2 in one channel.
– Change in state from “1” to “0”:
The faulty input remains at “1”. A “0” is transmitted in the process data
image of the affected inputs.
– Change in state from “0” to “1”:
A “0” is transmitted in the process data image of the inputs, as the
faulty input was not previously set to “0”.
Input to ground Yes None No The error is detected in state “1” or on a change in state from “0” to “1”,
as the state only changes in one channel.
Clock output that is not clocked No None No The error is not detected.
to external 24 V
Clock output to ground Yes Short circuit No The error is detected as a change in state from “1” to “0”. An
unexpected change from “0” to “1” is possible.
Make sure that this change in state cannot restart the system
unintentionally.
The error is also detected as a short circuit of the clock output. The
affected clock output is disabled.

56 PHOENIX CONTACT 106887_en_01

 Connection examples for safe inputs

Table 7-6 Two-channel equivalent, cross-circuit monitoring disabled: supply through a clock output or external supply
Error type Detection Diagnostics Loss of Comment
SF1
External 24 V to ground Yes None No The error is detected as a change in state from “1” to “0”. An
unexpected change from “0” to “1” is possible.
Make sure that this change in state cannot restart the system
unintentionally.
1
SF = safety function
2
Only applies when symmetry monitoring is active

For all inputs that are parameterized without cross-circuit monitoring, cross-circuits and
short circuits are not detected by the device diagnostics, but only on a change in state of
the input signals, as the state only changes in one channel.

WARNING: Loss of safety function

An accumulation of errors can result in the loss of the safety function.
• Test the safety function at regular intervals to detect errors at an early stage.

Typical parameterization

Parameterization Parameterized as Comment

Input xx channel 1/channel 2
Assignment Two-channel equivalent
Filter time (tFilter) 3 ms Application-specific
Symmetry 100 ms Application-specific
Start inhibit due to symmetry Disabled Application-specific
violation
Cross-circuit monitoring No cross-circuit monitoring

106887_en_01 PHOENIX CONTACT 57

AXL F SSDI8/4 1F

7.4.4 External supply (OSSD)

OSSD
+24 V

IN1_Ch1

IN1_Ch2

GND 7

Figure 7-10 Two-channel equivalent assignment of inputs,

external supply (OSSD)

WARNING: Loss of safety function

Parasitic voltages can result in the loss of the safety function.
• Connect the sensor ground directly to terminal point GND of the safety module. An
external ground may not be used.

Basic specifications

Sensor Two-channel OSSD output (with internal testing)

Sensor supply External (OSSD sensor)
Achievable SIL 3/SILCL 3/Cat. 4/PL e
safety integrity

58 PHOENIX CONTACT 106887_en_01

 Connection examples for safe inputs

Device diagnostics and behavior of the module in the event of an error

Observe the information to understand the change in state: see see “Example of correct
and incorrect signal change” on page 51.

Table 7-7 Two-channel equivalent: external supply (OSSD)

Error type Detection Diagnostics Loss of Comment
SF1
Error in the sensor
Channel failure Yes Symmetry No The error is detected on a change in state, as the state only changes
violation2 in one channel.
– Change in state from “1” to “0”:
The faulty input remains at “1”. A “0” is transmitted in the process data
image of the affected inputs.
– Change in state from “0” to “1”:
A “0” is transmitted in the process data image of the affected inputs,
as the faulty input was not previously set to state “0”.
Other errors Please take into consideration errors that can occur in the sensor.
(depending on the sensor)
Error in the wiring
Interrupt
Input Yes Symmetry No The error is detected in state “1” or on a change in state from “0” to
(cable interrupt between sensor violation2 “1”, as the state only changes in one channel.
and input)
Input No None No The error must be detected by the sensor.
(cable interrupt between sensor The sensor must ensure that the safe state is entered in the event of
and GND) an error.
Cross-circuit
Input to input No None Yes The error must be detected by the sensor.
The sensor must ensure that the safe state is entered in the event of
an error.
Input to clock output Yes Symmetry No The error is detected on a change in state if the clock output is set to
violation2 “1”, as the state only changes in one channel.
Short circuit
Input to 24 V Yes Symmetry No The error is detected on a change in state, as the state only changes
violation2 in one channel.
Input to ground Yes Symmetry No The error is detected in state “1” or on a change in state from “0” to
violation2 “1”, as the state only changes in one channel.
1 SF = safety function
2
Only applies when symmetry monitoring is active

106887_en_01 PHOENIX CONTACT 59

AXL F SSDI8/4 1F

Typical parameterization

Parameterization Parameterized as Comment

Input xx channel 1/channel 2
Assignment Two-channel equivalent
Filter time (tFilter) 3 ms Application-specific
Symmetry 100 ms Application-specific
Start inhibit due to symmetry Disabled Application-specific
violation
Cross-circuit monitoring No cross-circuit monitoring

Set the filter time for the input to a value greater than the width of the test pulse for the
OSSD sensor.
Cross-circuit detection must be disabled.

7.5 Two-channel non-equivalent assignment of safe

inputs

For two-channel assignment of the safe inputs, two adjacent inputs of the same connector
are always used. This assignment cannot be parameterized: see “Two-channel” on
page 36.
For two-channel non-equivalent assignment, the state changes from “0” to “1” only when
input INx_Ch1 changes state from “0” to “1” and input INx_Ch2 changes state from “1” to
“0”. If symmetry monitoring is enabled and the state at both inputs does not change during
the parameterized time, a diagnostic message is generated.
The state is active when the state of the signal at channel 1 is equal to “1” and the signal at
channel 2 is equal to “0”.

Please note that if a delayed change in state at one of the two inputs causes the safety
switch to be switched on again, this can result in delayed transmission of state “1” in the
process data image of the inputs.

60 PHOENIX CONTACT 106887_en_01

 Connection examples for safe inputs

Example of correct and incorrect signal change

IN0_Ch1 1
0
IN0_Ch2 1
0
IN0 (Ch1/Ch2) 1
0
Figure 7-11 Correct signal change

IN0_Ch1 1
0
IN0_Ch2 1
0
IN0 (Ch1/Ch2) 1
0
Figure 7-12 Error during signal change

Key for Figure 7-11 and Figure 7-12

IN0_Ch1 Signal sequence at input 0 channel 1

IN0_Ch2 Signal sequence at input 0 channel 2
IN0 (Ch1/Ch2) Safety-related signal for two-channel input 0, channel 1 and
channel 2 at the logic module

In Figure 7-12, the condition that both signals must be in the opposite state before the
change in state is not met. In this case, the diagnostic message is generated.

State evaluation
The module evaluates the states of the inputs and transmits the result to the logic module.
The following values are transmitted in the process data image of the safe inputs:
– “1” if a “1” signal is present at channel 1 of the input and a “0” signal is present at channel
2 of the input and no error has been detected and the conditions are met for a change
in state according to Figure 7-12.
– “0” is transmitted in all other cases.

106887_en_01 PHOENIX CONTACT 61

AXL F SSDI8/4 1F

7.5.1 Notes on errors

Please observe the following notes on cross-circuit and symmetry violation:

Cross-circuit
The cross-circuit error results in the transmission of the safe state in the process data image
of the affected inputs.
• Remove the error and then acknowledge the message.
Acknowledging the diagnostic message deletes the message and activates the input. The
states at the input are detected immediately.
• In the safe application program, make sure that the system cannot be restarted
unintentionally after acknowledging the diagnostic message.
• Observe the maximum failure detection time of 64 ms.
Exceptions in the failure detection time are indicated in the tables below.
If a “1” signal is present at the input and an error occurs, a maximum of 64 ms elapses until
the error is detected. During this time, another “1” can be transmitted, even in the event of
an error.
During the failure detection time, the error can cause the state to change unexpectedly from
“0” to “1”.
• Make sure that the system cannot be restarted unintentionally as a result of this change
in state.

Symmetry violation
– The symmetry violation diagnostic message is only displayed if it was not disabled
during parameterization of the affected input.
– Start inhibit due to symmetry violation disabled:
The symmetry violation message does not result in the transmission of the safe state:
see “Symmetry/ start inhibit” on page 37.
The message must be acknowledged. However, the current status of the inputs is
always displayed in the process data image of the inputs.
– Start inhibit due to symmetry violation enabled:
The symmetry violation message results in the transmission of the safe state: see
“Symmetry/ start inhibit” on page 37.
The message must be acknowledged. Following acknowledgment, the current status
of the inputs is displayed in the process data image of the inputs.
– The message can be used to monitor the wear of the safety switch.

62 PHOENIX CONTACT 106887_en_01

 Connection examples for safe inputs

7.5.2 Cross-circuit monitoring enabled, supply through T1 and

T2

IN1_Ch1 S1
S1, S2 Two switching elements
T1
IN1_Ch2
S2
T2

Figure 7-13 Two-channel non-equivalent assignment of inputs,

supply through T1 and T2, cross-circuit monitoring enabled

Basic specifications

Sensor Two-channel non-equivalent

Sensor supply Internally through clock output T1 and T2, cross-circuit monitoring enabled
Achievable SIL 3/SILCL 3/Cat. 4/PL e
safety integrity

Observe the information to understand the change in state: see see “Example of correct
and incorrect signal change” on page 61.

Device diagnostics and behavior of the module in the event of an error

Table 7-8 Two-channel non-equivalent with cross-circuit monitoring: supply through T1 and T2
Error type Detection Diagnostics Loss of Comment
SF1
Error in the sensor
A contact fails to open Yes Symmetry No The error is detected, as the state only changes in one channel.
A contact fails to close violation2
Other errors Please take into consideration errors that can occur in the sensor.
(depending on the sensor)
Error in the wiring
Interrupt
Input Yes Symmetry No The error is detected on a change in state at the latest, as the state
(cable interrupt between clock violation2 only changes in one channel.
output and sensor or between
sensor and input)
Cross-circuit
Input to input Yes Cross-circuit No The error is detected if the other input is set to “1”.
Input to assigned clock output Yes Symmetry No The error is detected on a change in state, as the state only changes
violation2 in one channel.
Input to non-assigned clock Yes Cross-circuit No see “Cross-circuit” on page 62.
output
Clock output to clock output Yes Cross-circuit No The error is detected for inputs which are assigned to different clock
outputs.
Short circuit
Input to ground Yes None No The error is detected on a change in state at the latest, as the state
only changes in one channel.

106887_en_01 PHOENIX CONTACT 63

AXL F SSDI8/4 1F

Table 7-8 Two-channel non-equivalent with cross-circuit monitoring: supply through T1 and T2
Error type Detection Diagnostics Loss of Comment
SF1
Clock output to ground Yes Short circuit No The error is detected on a change in state at the latest, as the state
only changes in one channel.
The error is also detected as a short circuit of the clock output.
The affected clock output is disabled.
1
SF = safety function
2
Only applies when symmetry monitoring is active

An error in input circuit INx_Ch2 can only be detected in the event of a requested safety
function.

WARNING: Loss of safety function

An accumulation of errors can result in the loss of the safety function.
• Test the safety function at regular intervals to detect errors at an early stage.

Typical parameterization

Parameterization Parameterized as/value range Comment

Input xx channel 1/channel 2
Assignment Two-channel non-equivalent
Filter time (tFilter) 3 ms Application-specific
Symmetry Disabled Application-specific
Start inhibit due to symmetry Disabled Application-specific
violation
Cross-circuit monitoring Cross-circuit monitoring

7.5.3 Cross-circuit monitoring disabled, supply through a clock

output or external supply

S1, S2
IN1_Ch1 S1
Two switching elements
IN1_Ch2 T1 (T2)
S2 Supply through T1 or T2
T1 (T2)
Figure 7-14 Two-channel non-equivalent assignment of inputs,
supply through T1 (or T2), cross-circuit monitoring disabled

64 PHOENIX CONTACT 106887_en_01

 Connection examples for safe inputs

S1, S2
S1 Two switching elements
IN1_Ch1
+24 V
IN1_Ch2
S2 Supply through external 24 V
+24 V

Figure 7-15 Two-channel non-equivalent assignment of inputs,

external supply

Basic specifications

Sensor Two-channel non-equivalent

Sensor supply Internally through clock output T1 (or T2) (clocking disabled) or externally
Achievable SIL 3/SILCL 3/Cat. 3/PL d
safety integrity

Observe the information to understand the change in state: see see “Example of correct
and incorrect signal change” on page 61.

Device diagnostics and behavior of the module in the event of an error

Table 7-9 Two-channel non-equivalent without cross-circuit monitoring: supply through a clock output or external
supply
Error type Detection Diagnostics Loss of Comment
SF1
Error in the sensor
A contact fails to open Yes Symmetry No The error is detected, as the state only changes in one channel.
A contact fails to close violation2
Other errors Please take into consideration errors that can occur in the sensor.
(depending on the sensor)
Error in the wiring
Interrupt
Input (cable interrupt between Yes Symmetry No The error is detected on a change in state at the latest, as the state
clock output and sensor or violation2 only changes in one channel.
between sensor and input)
Cross-circuit
Input to input Yes Symmetry No The error is detected, as the state only changes in one channel.
violation2
Input to clock output Yes Symmetry No The error is detected, as the state only changes in one channel.
violation2 – Change in state from “1” to “0”:
The faulty input remains at “1”. A “0” is transmitted in the process
data image of the affected inputs.
Clock output to clock output No None No The error is not detected.

106887_en_01 PHOENIX CONTACT 65

AXL F SSDI8/4 1F

Table 7-9 Two-channel non-equivalent without cross-circuit monitoring: supply through a clock output or external
supply [...]
Error type Detection Diagnostics Loss of Comment
SF1
Short circuit
Input to external 24 V Yes Symmetry No The error is detected on a change in state at the latest, as the state
violation2 only changes in one channel.
Input to ground Yes Symmetry No The error is detected in state “1” or on a change in state from “0” to
violation2 “1”, as the state only changes in one channel.
Clock output to external 24 V No None No The error is not detected.
Clock output to ground Yes Short circuit No The error is detected as a change in state from “1” to “0”.
The error is also detected as a short circuit of the clock output.
The affected clock output is disabled.
External 24 V to ground Yes Symmetry No The error is detected in state “1” or on a change in state from “0” to
violation2 “1”, as the state only changes in one channel.
1
SF = safety function
2
Only applies when symmetry monitoring is active

WARNING: Loss of safety function

An accumulation of errors can result in the loss of the safety function.
• Test the safety function at regular intervals to detect errors at an early stage.

Typical parameterization

Parameterization Parameterized as/value range Comment

Input xx channel 1/channel 2
Assignment Two-channel non-equivalent
Filter time (tFilter) 3 ms Application-specific
Symmetry 100 ms Application-specific
Start inhibit due to symmetry Enabled Application-specific
violation
Cross-circuit monitoring No cross-circuit monitoring

66 PHOENIX CONTACT 106887_en_01

 Startup and validation

8 Startup and validation

8.1 Initial startup

Table 8-1 Steps for startup

Step Relevant section and literature

Set the address. “Setting the DIP switch” on page 30
Install the module in the Axioline F station. “Assembly, removal, and electrical installation” on page 29
UM EN AXL F SYS INST user manual
Connect the bus system and supply voltage cables to the UM EN AXL F SYS INST user manual or documentation for
Axioline F station. the bus coupler
Wire the inputs according to your application. “Connection examples for safe inputs” on page 41
Before applying the operating voltage:
– Make sure that there are no wiring errors (e.g., cross-
circuit or short circuit) or grounding errors by testing with
a multimeter.
– Make sure that functional earth ground is connected.
Connect the necessary voltages to the Axioline F module. UM EN AXL F SYS INST user manual or documentation for
the module
Once the operating voltage has been applied:
– If possible, measure the waveform of the voltages to
make sure that there are no deviations.
– Measure the input voltages on the module to make sure
that they are in the permissible range.
– Use the LEDs on the module to check that the module
starts up without any errors.
Check the assembly and installation. Checklist: see Appendix A 2 “Assembly and electrical
installation”
Carry out the necessary parameterization. “Parameterization of the module” on page 35
Documentation for the logic module used (SafetyBridge)
Program the safety function. Online help for the SAFECONF configuration software
Perform a function test and validation. Check whether the Checklist: see Appendix A 4 “Validation”
safety function responds as planned during programming
and parameterization.
When connecting the supply voltages, use the diagnostics Instructions on how to proceed in the event of an error: see
and status indicators to check whether the module has “Errors: messages and removal” on page 71
started up correctly or whether any errors are indicated.

106887_en_01 PHOENIX CONTACT 67

AXL F SSDI8/4 1F

8.1.1 Startup mode

WARNING: Risk due to standard operation

The module is not safe in startup mode, as all partial safety functions are deactivated.
Unintentional system states or incorrect responses cannot be ruled out.
• Do not enter any danger zones and make sure that no other persons can access the
danger zone either.
The device features a startup mode in which the Startup+ software can be used to perform
the following functions:
– Wiring check
– Read inputs
– Read and acknowledge diagnostic messages
Startup mode is set using the DIP switch on the top of the module, see Section 4.1.3 “Setting
the DIP switch” on page 30.
To enter startup mode, proceed as follows:
1. Set position 11 of the DIP switch to “on”.
2. Carry out a power up.
The red CM LED indicates that the device is in startup mode.
3. In the Startup+ software, enter the address set on the device.

For additional information on the Startup+ software, refer to the documentation for the
software.
The software can be downloaded free of charge at phoenixcontact.net/products.

68 PHOENIX CONTACT 106887_en_01

 Startup and validation

8.2 Restart after replacing a module

8.2.1 Replacing a module

WARNING: Unintentional machine startup

Make sure that the power to the system is disconnected before carrying out assembly and
removal work as this could cause unintentional machine startup.
• Before assembling or removing the module, disconnect the power to the module and
the entire Axioline F station and make sure that the system cannot be switched on
again.
• Make sure the entire system is reassembled before switching the power back on and
that neither the station nor the system poses a hazard.
Observe the diagnostics indicators and any diagnostic messages.
If replacing a module, proceed as described for assembly and removal: see Section 4
“Assembly, removal, and electrical installation” on page 29 or Axioline F: system and
installation user manual, UM EN AXL F SYS INST.
• Install the new module at the correct position in the station.
• Observe the color coding of the connector/slot when mounting the connectors.
The new module must meet the following requirements:
– Same device type
– Same or later version

8.2.2 Restart

Once the module has been replaced, proceed as described for initial startup: see
Section 8.1 “Initial startup” on page 67.
The parameterization of the previous module remains the same and is transmitted to the
new module when the system is started.

8.3 Validation

Carry out a safety validation every time you make a safety-related modification.
• When validating your EUC, check the assignment of the individual sensor connections.
• Make sure that the following requirements are met:
– The correct safe sensors are connected to the module.
– The parameterization of the module is correct.
– The variables used in your application program have been linked to the safe
sensors correctly.
• Perform a function test and error simulation.
Observe the information on validation provided in the checklist: see Section A 4 “Validation”
on page 89.

106887_en_01 PHOENIX CONTACT 69

AXL F SSDI8/4 1F

70 PHOENIX CONTACT 106887_en_01

 Errors: messages and removal

9 Errors: messages and removal

9.1 Displaying and reading errors

Diagnostics indicators Depending on the error type, errors that are diagnosed are displayed via the local
and diagnostic messages diagnostics indicators and/or transmitted to the logic module as diagnostic messages.
Depending on the controller, the SafetyBridge function blocks provide error codes. In order
to determine what type of error has occurred, use the corresponding software to access the
standard controller online and read the error.
Please also refer to the documentation for the logic module used.

9.2 Acknowledging an error

Acknowledgment An AXL F SSDI8/4 1F error is acknowledged completely via the “Operate” function block.

WARNING: Acknowledgment may result in a hazardous system state

With the exception of a few special cases, the acknowledgment of an error immediately
returns the safe input or output to the operating state.
• Before acknowledging an error you must therefore make sure that the
acknowledgment will not cause the machine to switch to a hazardous state.
• When planning the machine or system, make sure that acknowledgment is only
possible if the danger zone is visible.

For instructions on error acknowledgment, please refer to the documentation for the logic
module used.

9.3 Module replacement following an error

If the safety module is replaced in the event of an error, proceed as described in “Assembly,
removal, and electrical installation” on page 29 and “Restart after replacing a module” on
page 69.

106887_en_01 PHOENIX CONTACT 71

AXL F SSDI8/4 1F

9.4 Note about the error codes

Error cause and The error code of a diagnostic message consists of the code for the error cause and the
error location code for the error location.
Refer to the examples below for an explanation of the error codes.

Table 9-1 Examples explaining the error codes

Error Error LED Error cause Effect Solution

Higher-level error code; code location Error description Acknowledgme
x = error location (hex) nt
012x SD Cross-circuit ... ...
0120 IN0_Ch1 on
Detailed error code with ...
... ...
error location
012B IN3_Ch2

018x SD Error during ... ...

0180 IN0_Ch1&2 on signal change
Error location: input
and channel ...
4YYY - No error ... ...
YYY = not relevant – SafetyBridge
address is
displayed

Additional information about the error,

possible solutions, and acknowledgment
behavior.

Examples from Table 9-1:

0120: cross-circuit at IN0_Ch1 (input 0 channel 1)
0180: error during signal change at IN0_Ch1&2 (input 0 channel 1 and 2)
4021: no error; the SafetyBridge address is displayed

The error codes are listed in ascending order in Table 9-2 “Error codes”.

If error codes are indicated by the system which do not appear in the table, please contact
Phoenix Contact.

72 PHOENIX CONTACT 106887_en_01

 Errors: messages and removal

9.5 Error codes

Table 9-2 Error codes

Error Error LED Error cause Effect Solution

code location Error description Acknowledgment
(hex)
012x SD on Cross-circuit Affected input is in the 1. Check sensor
0120 IN0_Ch1 – With another input or safe state 2. Check clock outputs
0121 IN1_Ch1 with a clock output 3. Check connector and
0122 IN2_Ch1 cabling
0123 IN3_Ch1
0128 IN0_Ch2
Acknowledgment:
0129 IN1_Ch2 Acknowledgment deletes the
012A IN2_Ch2 message and activates the
012B IN3_Ch2 input.  The states at the input
are detected immediately.
013x SD on Symmetry violation “Start inhibit due to 1. Check whether the
0130 IN0_Ch1&2 – Not safety-related symmetry violation” is message was triggered by
0131 IN1_Ch1&2 – Only for inputs disabled: a short circuit/cross-circuit
0132 IN2_Ch1&2 parameterized for – Inputs continue to be If not:
0133 IN3_Ch1&2 two-channel operation detected and their
1. Check value for symmetry
– Used to evaluate the states transmitted to
the logic module 2. Check switches
contacts of connected
3. Replace switches during
switches “Start inhibit due to next maintenance
– State change in both symmetry violation” is
4. Activate connected I/O
channels takes longer enabled:
devices once (e.g.,
than the value – Affected input is in activate and unlock
parameterized for the safe state emergency stop)
symmetry
Acknowledgment:
Message can also be
triggered by a cross- “Start inhibit due to symmetry
circuit/short circuit violation” is disabled:
– Acknowledgment deletes
the message.
“Start inhibit due to symmetry
violation” is enabled:
– Acknowledgment deletes
the message and activates
the input.  The states at
the input are detected
immediately.

106887_en_01 PHOENIX CONTACT 73

AXL F SSDI8/4 1F

Table 9-2 Error codes

Error Error LED Error cause Effect Solution

code location Error description Acknowledgment
(hex)
014x SD on Hardware fault All module inputs are in 1. Perform power up (with
0140 IN0_Ch1 the safe state selftest)
0141 IN1_Ch1 If the selftest following power
0142 IN2_Ch1 up is not error-free:
0143 IN3_Ch1
2. Replace module
0148 IN0_Ch2
0149 IN1_Ch2 Acknowledgment:
014A IN2_Ch2
Acknowledgment deletes the
014B IN3_Ch2
message. Restart is only
0170 - SD on possible following power up
and error-free selftest.
018x SD on Error during signal Affected inputs in the safe 1. Set both inputs to the safe
0180 IN0_Ch1&2 change state state
0181 IN1_Ch1&2 – Only for inputs Acknowledgment:
0182 IN2_Ch1&2 parameterized for
0183 IN3_Ch1&2 two-channel operation Acknowledgment deletes the
message.
– Implausible signal
change at indicated
input pair
01Ex SD on Short circuit or overload Affected clock output is Module parameterized:
01E0 Clock output – The clock outputs are disabled 1. Check connector and
T1 also switched on and cabling
Assigned inputs are set to
01E8 Clock output monitored when not
T2 “0” 2. If necessary, acknowledge
parameterized. If a error at all inputs
short circuit occurs at
a clock output when it Module not parameterized:
is in this state, the 1. Carry out parameterization
clock output is Acknowledgment:
switched off.
Acknowledgment deletes the
message and activates the
clock output and the assigned
inputs.  The states at the
input are detected immediately.
01F0 - UI Undervoltage UI All module inputs are in 1. Check supply voltage level
flashing – Supply voltage is the safe state and correct
SD on below the permissible 2. Check supply line length
voltage range and load
– If UI < 17 V, a Acknowledgment:
diagnostic message is
generated Acknowledgment deletes the
message and activates the
input.  The states at the input
are detected immediately.

74 PHOENIX CONTACT 106887_en_01

 Errors: messages and removal

Table 9-2 Error codes

Error Error LED Error cause Effect Solution
code location Error description Acknowledgment
(hex)
01F2 - SD on Critical device Immediate shutdown. A Check and adapt the following
temperature further temperature if necessary:
increase causes the – Ambient conditions
module to switch to the – Derating
safe state.
– Switching frequency
Acknowledgment:
Acknowledgment deletes the
message.
034x FS Incorrect Module is in the safe state 1. Disable symmetry
0340 IN0_Ch1&2 flashing parameterization monitoring or parameterize
0341 IN1_Ch1&2 – Symmetry monitoring two-channel operation
0342 IN2_Ch1&2 has been 2. Resend parameter data to
0343 IN3_Ch1&2 parameterized, even the module
though single-channel (deactivate/activate
operation is used for “Operate” block)
the input pair
Acknowledgment: not
possible
035x FS Incorrect Module is in the safe state Single-channel assignment:
0350 IN0_Ch1&2 flashing parameterization 1. Deactivate start inhibit due
0351 IN1_Ch1&2 – “Start inhibit due to to symmetry violation
0352 IN2_Ch1&2 symmetry violation” 2. Resend parameter data to
0353 IN3_Ch1&2 has been the module
parameterized and (deactivate/activate
single-channel “Operate” block)
operation is used for
the input pair Two-channel assignment:
1. Activate symmetry
and/or monitoring
– Symmetry monitoring 2. Resend parameter data to
is not activated the module
(deactivate/activate
“Operate” block)
Acknowledgment: not
possible
0440 - SD on Incorrect SafetyBridge Module is in the safe state 1. Deactivate the “Operate”
address block.
– The parameterized 2. See message “4YYY” on
SafetyBridge address page 76.
does not match the
Acknowledgment: not
address set on the
possible
safety module

106887_en_01 PHOENIX CONTACT 75

AXL F SSDI8/4 1F

Table 9-2 Error codes

Error Error LED Error cause Effect Solution
code location Error description Acknowledgment
(hex)
0441 - SD on Internal error Module is in the safe state Please contact
... Phoenix Contact.
0446
Acknowledgment: not
possible
0447 - SD on Incorrect configuration Module is in the safe state 1. Resend parameter data to
and parameter data the module
record (deactivate/activate
– The device detected “Operate” block)
an error in the If the error occurs permanently:
configuration and
2. Generate new data record
parameter data record
in SAFECONF
Acknowledgment: not
possible
109A - FS on DIP switch moved Module is in the safe state 1. Check DIP switch position
during operation and bring in line with
SAFECONF project
2. Perform power up
Acknowledgment:
Not possible. Restart is only
possible following power up
and error-free selftest.
1YYY - FS on Internal error Module is in the safe state Please contact
Phoenix Contact.
Acknowledgment: not
possible
4YYY - FS No error Module is in the safe state 1. Check DIP switch position
flashing – “Operate” block has and bring in line with
been deactivated SAFECONF project
– SafetyBridge address See Table 4-1 on page 30 and
is displayed documentation for the logic
module.
2. Activate “Operate” block
8000 - P on No error - -

76 PHOENIX CONTACT 106887_en_01

 Maintenance, repair, decommissioning, and disposal

10 Maintenance, repair, decommissioning, and disposal

10.1 Maintenance

The module does not require maintenance. Depending on the application and connected
I/O devices, the function of the I/O devices and the safety chain must be tested regularly.
The duration of use of the module is 20 years, or 25 years with a low demand rate.
Repeat testing during this time is not required.
• Carry out maintenance on connected I/O devices (e.g., light grid) according to the
manufacturer specifications.

10.2 Repair

It is prohibited for the user to carry out repair work or make modifications to the module. The
housing must not be opened. The module is protected against tampering by means of
security labels. The security label is damaged in the event of unauthorized repairs or
opening of the housing. In this case, the correct operation of the safety module can no
longer be ensured.
• In the event of an error, send the module to Phoenix Contact or contact
Phoenix Contact immediately and engage a service engineer.

10.3 Decommissioning and disposal

Carry out decommissioning according to the requirements of the machine or system

manufacturer.
When decommissioning the system or parts of the system, ensure the following for the
modules used:

Fate of the module Measure

The modules will continue to be used Observe the storage and transport
correctly. requirements according to the technical
data: see Section 11.2 “AXL F SSDI8/4 1F
module data” on page 79.
Modules will no longer be used. Dispose of modules in accordance with the
environmental regulations. Make sure that
the modules can never be reused.

106887_en_01 PHOENIX CONTACT 77

AXL F SSDI8/4 1F

78 PHOENIX CONTACT 106887_en_01

 Technical data and ordering data

11 Technical data and ordering data

11.1 SafetyBridge system data

For the system data for the SafetyBridge system, please refer to the documentation for the
logic module.

11.2 AXL F SSDI8/4 1F module data

General data
Housing dimensions without bus base module with connector (width x height 53.6 mm x 126.1 mm x 54 mm
x depth)
Weight (with connectors) 220 g, approximately
Operating mode
SafetyBridge Process data mode with 4 words
Ambient temperature
Operation -35°C to +60°C (any mounting position)
Storage/transport -40°C to +85°C
Humidity
Operation 75% on average, 85% occasionally (non-condensing)

Measures against increased humidity must be taken.

Storage/transport: 75% (non-condensing)

For a short period, slight condensation may appear on the outside of the housing.

Air pressure
Operation 70 kPa to 108 kPa (up to 3000 m above sea level)
Storage/transport 66 kPa to 108 kPa (up to 3500 m above sea level)
Degree of protection IP20; operation in at least IP54 installation space
Housing material Plastic PBT, self-extinguishing (V0)
Air clearances and creepage distances According to IEC 60664-1
Protection class III (PELV)
Gases that may endanger functions according to DIN 40046-36, Not resistant to gas that may endanger functions (sulfur dioxide (SO2),
DIN 40046-37 hydrogen sulfide (H2S))
Resistance of the housing material to fungal decay Resistant
Ambient compatibility Not resistant to organic chlorine compounds

106887_en_01 PHOENIX CONTACT 79

AXL F SSDI8/4 1F

General data [...]

Connection data for Axioline F connectors
Connection method Spring-cage terminal blocks
Conductor cross section Solid: 0.5 mm2 to 1.5 mm2
Flexible without sleeve: 0.25 mm2 to 1.5 mm2
Flexible with sleeve: 0.25 mm2 to 1.5 mm2
24 - 16 AWG

UL note:
Use copper wire that is approved up to 75°C.

Mechanical requirements
Vibration according to IEC 60068-2-6 10 - 57 Hz: 0.35 mm with constant amplitude
57 - 150 Hz; 5g acceleration, constant amplitude
Shock according to IEC 60068-2-27 30g over 11 ms, Criterion A

Safety characteristics according to EN 61508

Achievable SIL SIL 2 (single-channel)
SIL 3 (two-channel)
Depends on the parameterization and wiring: see Section 2.6 “Connection
options for sensors depending on the parameterization” on page 18, see
Section 7 “Connection examples for safe inputs” on page 41
Probability of a dangerous failure on demand by the safety function (PFD)
For single-channel assignment 1% of 10-2, maximum (corresponds to 1 x 10-4)
For two-channel assignment 1% of 10-3, maximum (corresponds to 1 x 10-5)
Probability of a dangerous failure per hour for the entire module (PFH) Depends on the parameterization
For single-channel assignment 1% of 10-6, maximum (corresponds to 1 x 10-8)
For two-channel assignment 1% of 10-7, maximum (corresponds to 1 x 10-9)
Hardware fault tolerance (HFT) of the module 1
Permissible duration of use 20 years, 25 years with a low demand rate

Safety characteristics according to EN 62061

Achievable SIL claim limit SILCL 2 (single-channel)
SILCL 3 (two-channel)
Depends on the parameterization and wiring: see Section 2.6 “Connection
options for sensors depending on the parameterization” on page 18, see
Section 7 “Connection examples for safe inputs” on page 41
Safe failure fraction (SFF) 99%
Probability of a dangerous failure per hour for the entire module (PFH) Depends on the parameterization
For single-channel assignment 1% of 10-6, maximum (corresponds to 1 x 10-8)
For two-channel assignment 1% of 10-7, maximum (corresponds to 1 x 10-9)
Hardware fault tolerance (HFT) of the module 1
Permissible duration of use 20 years, 25 years with a low demand rate
Operation in the error state: 72 h

80 PHOENIX CONTACT 106887_en_01

 Technical data and ordering data

Safety characteristics according to EN ISO 13849-1

Achievable performance level PL d (single-channel)
PL e (two-channel)
Depends on the parameterization and wiring: see Section 2.6 “Connection
options for sensors depending on the parameterization” on page 18, see
Section 7 “Connection examples for safe inputs” on page 41
Diagnostic coverage (DC) 99%
Mean time to dangerous failure (MTTFd) 100 years (regardless of whether single-channel or two-channel assignment)

Supply voltage UBUS (logic)

The bus coupler or a feed-in terminal in the station supply the module with communications power UBUS.
For the technical data, please refer to the data sheet for the bus coupler or the feed-in terminal.

Communications power 5 V DC
Current consumption from UBUS 280 mA, typical (all inputs set; supply by UI of 19.2 V DC to 30.2 V DC)
310 mA, maximum

Supply voltage UI (sensors, clock outputs, I/O)

WARNING: Loss of safety function

The use of unsuitable power supplies can result in the loss of the safety function.
• Use power supplies according to EN 50178/VDE 0160 (PELV).

Nominal voltage 24 V DC according to EN 61131-2 and EN 60204

Ripple 3.6 VPP
Permissible voltage range 19.2 V DC to 30.2 V DC (including all tolerances, ripple included)
Current consumption 9 mA, typical
(all inputs set; supply by UI with 30.2 V DC; without supply to the sensors via
clock supplies T1 and T2)
Permissible interrupt time 1 ms
(output voltage of the clock outputs can fail)
Surge protection Yes
Protection against polarity reversal Parallel protection against polarity reversal for a limited period

NOTE: Module damage

Parallel protection against polarity reversal is only implemented in the module for a limited period. The following measures must be taken to
prevent damage to the module:
• Due to the maximum current carrying capacity of 8 A, protect power supply UI externally with an 8 AT fuse.
• Only use PELV power supply units with at least four times the nominal tripping current, as this is the only way to ensure tripping times of
less than 300 ms.

Undervoltage detection At 16.6 V

Diagnostics indicators Green UI LED
see Section 2.7 “Local diagnostics and status indicators” on page 19
External protection 8 A slow-blow, maximum

Safe digital inputs

Quantity 4 two-channel or 8 single-channel
Input design According to the requirements of EN 61131-2 Type 3
Supply Via clock outputs T1 and T2 or external supply
Input current Approximately 4.2 mA at 24 V, typical
Maximum permissible current for “0” 2 mA

106887_en_01 PHOENIX CONTACT 81

AXL F SSDI8/4 1F

Safe digital inputs [...]

Minimum permissible current for “1” 2.5 mA
Permissible input voltage range -3 V to +30.2 V
Voltage range for “0” -3 V to +5 V
Voltage range for “1” 11 V to 30 V
Maximum switching frequency 10 Hz
Filter time tFilter 1.5/3/5/15 ms (can be parameterized): see “Filter time (tFilter)” on page 36
Accuracy of filter time +0 ms, -0.5 ms
Processing time of the input tIN = tFilter + tFW
See “Processing time of input tIN in the event of a safety demand” on page 38
Simultaneity 100%
Symmetry evaluation Yes, can be parameterized, accuracy ±20%
Derating No
Permissible cable lengths 1000 m from clock output to safe input (total length of the connected cables)
Status indicators One green LED per input
see Section 2.7 “Local diagnostics and status indicators” on page 19

The switching state of the inputs is constantly monitored. In the event of an error, e.g., if a component fails, the error is reported to the logic
module.

Clock outputs
Quantity 2
Supply From UI
Limiting continuous current (total) 0.4 A short-circuit and overload protection
Saturation voltage UI - 1 V
Simultaneity 100%
Derating No
Permissible cable lengths The total length of the connected cables must not exceed 1000 m per clock
output
Status indicators None

Approvals
For the latest approvals, please visit phoenixcontact.net/products.

82 PHOENIX CONTACT 106887_en_01

 Technical data and ordering data

11.3 Conformance with EMC Directive

Conformance with EMC Directive 2014/30/EU

Noise immunity test according to DIN EN 61000-6-2
Electrostatic discharge (ESD) EN 61000-4-2 Criterion A
(IEC 61000-4-2) 6 kV contact discharge, 8 kV air discharge
Electromagnetic fields EN 61000-4-3 Criterion A, field strength 10 V/m
(IEC 61000-4-3)
Fast transients (burst) EN 61000-4-4 Criterion A, test voltage 2 kV
(IEC 61000-4-4)
Transient overvoltage (surge) EN 61000-4-5 Test intensity 2, Criterion A
(IEC 61000-4-5) DC supply lines:
1.0 kV/1.0 kV (symmetrical/asymmetrical)
Signal lines:
1.0 kV/2.0 kV (symmetrical/asymmetrical)
Conducted disturbance variables EN 61000-4-6 Criterion A, test voltage 10 V
(IEC 61000-4-6)

Noise emission test according to DIN EN 61000-6-3

Noise emission EN 55022 Class B, residential

11.4 Ordering data: module

Description Type Order No. Pcs./Pkt.

Axioline F module with safe digital inputs AXL F SSDI8/4 1F 2702263 1

11.5 Download data: software

Make sure you always use the latest software. The software can be downloaded free of charge at
phoenixcontact.net/products.

Description Type Download area for Order

No.
SAFECONF
Configuration software for SafetyBridge technology and Trisafe SAFECONF 2986119
modules

STARTUP+
Software for starting up and parameterizing Axioline stations STARTUP+ 2700636

106887_en_01 PHOENIX CONTACT 83

AXL F SSDI8/4 1F

11.6 Download data: documentation

Make sure you always use the latest documentation. It can be found in the download area for the specified product
at phoenixcontact.net/products.

Description Type Download area for Order

No.
Axioline F
User manual UM EN AXL F SYS INST 2702263
Axioline F: system and installation
User manual UM EN AXL F SYS DIAG 2702263
Axioline F: diagnostic registers and error messages

SafetyBridge
User manual: UM EN AXL F LPSDO8/3 1F 2702171
Axioline F module with integrated safety logic and safe digital
outputs
SafetyBridge technology integration package for controllers from SBT_V3_PLC_Integration_Packages_1.8.exe 2702171
Phoenix Contact, Rockwell and Siemens (S7-1200 as of CPU
1214C, S7-1500, S7-300), Schneider as well as CODESYS-based
controllers.

The SafetyBridge V3 integration package contains various quick start guides for integrating the SafetyBridge
system with different controllers.

84 PHOENIX CONTACT 106887_en_01

A Appendix: checklists
The checklists listed in this section provide support when carrying out the following tasks on
the AXL F SSDI8/4 1F module: planning, assembly and electrical installation, startup,
parameterization, and validation.

These checklists may be used as planning documentation and/or as verification to ensure

the steps in the specified phases are carried out carefully.

Archive the completed checklists to use as reference for recurring tests.

The checklists do not replace the validation, initial startup, and regular testing performed by
qualified personnel.
The following section of a checklist shows an example of a completed checklist.
Checklist ...
Device type/equipment identification AXL F SSDI8/4 1F/BK20NA10
Version: HW/FW 00/101 Date 2008-01-17
Test engineer 1 John Smith Test engineer 2 Jane Brown
Comment System XXX has been checked for engine hood production
No. Requirement (mandatory) Yes Comment
X ...
No. Requirement (optional) Yes No Comment
Y ...

Key:
Equipment identification Enter the device type and/or the equipment identification for the relevant module.
Version: HW/FW Enter the hardware and firmware version of the module.
Date Enter the date on which you began to fill in this checklist.
Editor Enter the name of the editor.
Test engineer Enter the name of the test engineer.
Comment Where necessary, enter a comment.
Requirement (mandatory) These requirements must be met for a safety application, in order to complete the relevant
phase using the checklist.
Requirement (optional) These requirements are optional. For points that are not met, please enter a comment.

106887_en_01 PHOENIX CONTACT 85

AXL F SSDI8/4 1F

A1 Planning

Checklist for planning the use of the module

Device type/equipment identification

Version: HW/FW Date

Test engineer 1 Test engineer 2

Comment
No. Requirement (mandatory) Yes Comment
1 Has the current module user manual been used as the basis for Revision:
planning?
2 Are the sensors approved for connection to the module (according to
the technical data and parameterization options)?
3 Has the power supply been planned according to the specifications for
the protective extra-low voltage in accordance with PELV?
4 Is external protection of the module planned (according to the
specifications in this user manual for supply voltage UI)?
5 Are measures planned to prevent simple tampering?

6 Are measures planned to prevent connectors being mixed up?

7 Are requirements for the sensors and cable installation observed

according to the SIL/SILCL/Cat./PL to be achieved and is the
implementation planned?
8 Are the specifications for the parameterization for each channel
defined?
9 Has it been ensured that any person intentionally starting hazardous
movements can only do so with a direct view of the danger zone?
10 Does the planned use correspond to the intended use?

11 Are the ambient conditions as well as the maximum mechanical load

observed according to the technical data?
12 Have test intervals been defined and has the maximum duration of use
been taken into consideration?
No. Requirement (optional) Yes No Comment
13 Have the accessories to be used been planned according to the
ordering data in this user manual (cables, connectors)?
14 Have specifications for assembly and electrical installation been
defined (e.g., EPLAN) and communicated to the relevant personnel?
15 Have specifications for startup been defined and communicated to the
relevant personnel?
Date Signature (editor)

Date Signature (test engineer)

86 PHOENIX CONTACT 106887_en_01

 Assembly and electrical installation

A2 Assembly and electrical installation

Checklist for assembly and electrical installation of the module

Device type/equipment identification

Version: HW/FW Date

Test engineer 1 Test engineer 2

Comment
No. Requirement (mandatory) Yes Comment
1 Was assembly completed according to the specifications
(specifications from the planning phase or according to the user
manual)?
2 Was the module installed in the control cabinet (IP54) and secured
correctly?
3 Do the cable cross sections and installations correspond to the
specifications?
4 Does the connection technology correspond to the specifications in the
technical data and in the relevant user manual?
5 Is the address switch set correctly according to the specifications?

Date Signature (editor)

Date Signature (test engineer)

106887_en_01 PHOENIX CONTACT 87

AXL F SSDI8/4 1F

A3 Startup and parameterization

Checklist for startup and parameterization of the module

Device type/equipment identification

Version: HW/FW Date

Test engineer 1 Test engineer 2

Comment
No. Requirement (mandatory) Yes Comment
1 Was startup completed according to the specifications (specifications
from the planning phase or according to the user manual)?
2 During startup, is it ensured that any person starting hazardous
movements intentionally can only do so with a direct view of the danger
zone?
3 Are all parameters parameterized for the inputs and is the F_WD_Time
set correctly?
4 For inputs that are parameterized for two-channel operation, are both
channels parameterized correctly for each other?
5 Is the assignment to the clock outputs parameterized for the inputs?

6 Are the clock outputs parameterized?

No. Requirement (optional) Yes No Comment

7 Have safety distances that must be observed been calculated
according to the response and delay times implemented?
Date Signature (editor)

Date Signature (test engineer)

88 PHOENIX CONTACT 106887_en_01

 Validation

A4 Validation

Checklist for validating the module

Device type/equipment identification

Version: HW/FW Date

Test engineer 1 Test engineer 2

Comment
No. Requirement (mandatory) Yes Comment
1 Have all the mandatory requirements for the “Planning” checklist been
met?
2 Have all the mandatory requirements for the “Assembly and electrical
installation” checklist been met?
3 Have all the mandatory requirements for the “Startup and
parameterization” checklist been met?
4 Does the parameterization of the safe inputs and clock outputs
correspond to the version and the actual connection of the controlling
devices?
5 Has the assignment of the sensors to the inputs and the variables of the
safe application program been tested (online status in SafetyProg)?
6 Has a function test been performed to check all safety functions in
which the module is involved?
7 Have measures been taken to achieve a specific Cat.?

8 Do all cables correspond to the specifications?

9 Does the power supply correspond to the specifications for the

protective extra-low voltage in accordance with PELV?
10 Is external protection of the module implemented (according to the
specifications in this user manual for supply voltage UI)?
11 Have measures been taken to prevent simple tampering?

12 Are requirements for the sensors and cable installation observed

according to the SIL/SILCL/Cat./PL to be achieved?
13 Are the specifications for the parameterization for each channel
implemented?
14 Has it been ensured that any person intentionally starting hazardous
movements can only do so with a direct view of the danger zone?
Date Signature (editor)

Date Signature (test engineer)

106887_en_01 PHOENIX CONTACT 89

AXL F SSDI8/4 1F

90 PHOENIX CONTACT 106887_en_01

 Appendix: index

B Appendix: index
A F
Abbreviations ...............................................................12 Failure state ................................................................. 22
Artikel-Nummer ............................................................83 Filter time ..................................................................... 36
Assembly .....................................................................31 Firmware runtime ......................................................... 38
Bus base module....................................................31
Connector...............................................................32 H
Electronics module .................................................31 Housing dimensions .................................................... 14
Instructions .............................................................29
Location..................................................................29 I
Assignment ..................................................................36
Indicators, diagnostics and status ................................ 19
Single-channel .......................................................44
Inputs
Two-channel...........................................................50
Device errors.......................................................... 22
Equivalent .............................................................. 18
B I/O errors ................................................................ 21
Bouncing time ..............................................................37 Non-equivalent ....................................................... 18
Parameterization .................................................... 36
C Requirements for sensors ...................................... 15
Clocking .......................................................................17 Single-channel ....................................................... 18
Conformance with EMC Directive ................................83 Single-channel assignment .................................... 15
Cross ...........................................................................17 Two-channel .......................................................... 18
Cross-circuit monitoring Two-channel assignment ....................................... 15
Disabled ..................................................... 46, 55, 64 Installation.................................................................... 29
Enabled ...................................................... 44, 53, 63 Electrical ................................................................ 33
Current carrying capacity ....................................... 25, 26 Insulation rating............................................................ 10

D M
DC distribution network ................................................26 Maintenance ................................................................ 77
Decommissioning ........................................................77
Device errors O
Inputs .....................................................................22 Operating time ............................................................. 21
Serious errors.........................................................22 OSSD
Diagnostics indicators ..................................................19 Single-channel ....................................................... 48
Directives .....................................................................11 Two-channel .......................................................... 58
Disposal .......................................................................77
P
E Parameterization.................................................... 35, 39
Error codes (table) .......................................................73 Inputs ..................................................................... 36
Errors
Acknowledgment....................................................71
Messages and removal ..........................................71

106887_en_01 PHOENIX CONTACT 91

AXL F SSDI8/4 1F

PELV...................................................................... 10, 25
Power supply units .......................................................10
Processing time of the input .........................................38

Q
Qualified personnel ........................................................9

R
Removal.......................................................................29
Repair ..........................................................................77
Replacement, module ..................................................69
Restart .........................................................................69

S
Safe state.....................................................................21
Inputs ............................................................... 21, 22
Operating state.......................................................21
Safety integrity .............................................................42
Safety notes ...................................................................9
SafetyBridge address...................................................35
Sensors
Connection options ................................................18
Requirements.........................................................15
Standards ....................................................................11
Start inhibit due to symmetry violation..........................36
Startup .........................................................................67
Startup mode ...............................................................68
Status indicators ..........................................................19
Supply voltage
UBUS .....................................................................25
UI............................................................................25
Symmetry.....................................................................36

T
tFilter ............................................................................38
tFW ..............................................................................38
tIN ................................................................................38
Transmission speed
Setting ....................................................................30

U
Use, intended...............................................................11

V
Validation .....................................................................69

92 PHOENIX CONTACT 106887_en_01

C Appendix: revision history

Revision Date Contents

00 2016-03-22 First publication
01 2016-11-10 HW/FW revision updated page 2
Error code 035x and error location revised page 75
EMC Directive updated page 83

106887_en_01 PHOENIX CONTACT 93

AXL F SSDI8/4 1F

94 PHOENIX CONTACT 106887_en_01