FAQs

Remote IO Modules, or RIMs, require a Fusion controller or RIM Control Module (RCM) to operate. The RIM is an extension of the SIL3 safety system, with its on-board safety logic devices directly connected peer-to-peer with the controller via RIM ports. Though the RIM is powered by its own 24VDC supply, the SIL3 safety system will default to a safe state if a condition arises that breaks the connection between the controller and RIM. If a RIM is disconnected from the controller, all of its on-board IO cards will be put into a safe state.

Fusion.IO provides a robust platform for systems requiring high-level safety integrity and is fully compliant with the IEC 61508 SIL 3 standard, making it suitable for applications that demand the highest levels of safety assurance.

The Fusion.IO system offers safety-critical functionality designed to meet ISO 61508 and SIL 3 (Safety Integrity Level 3) requirements, which are crucial for industries where safety is a top priority, such as in machine control and automation.

Fusion.IO’s IEC 61508 SIL 3 compliance includes:

• TÜV Rheinland Certified: Fusion.IO systems are TÜV Rheinland certified, ensuring that the safety-related components meet the highest standards for functional safety.
• Safety Interlocks: Fusion.IO supports the implementation of software-defined safety interlocks across I/O channels. These interlocks are fully compliant with SIL 3 requirements and are a core component for ensuring safety in critical applications.
• Dual Redundancy: The system is designed with dual redundant communication channels, which enhances reliability and supports the architecture for SIL 3-rated applications.
• Safety Features: The Fusion.IO XT controller variants and Remote Interface Modules (RIMs) are also designed with safety functions that meet the necessary safety standards for SIL 3.

No, the Fusion safety system does not require a separate Safety PLC.

The Fusion.IO system itself is capable of implementing safety functions without the need for an external Safety PLC. It provides integrated safety interlocks and safety-rated I/O modules that are TÜV Rheinland certified and comply with IEC 61508 SIL 3 safety standards. This means the Fusion system is capable of performing safety-critical control and monitoring tasks directly, allowing for safety functions to be designed and executed within the Fusion architecture itself.

The response time of the DDI Fusion safety system is typically measured in microseconds and is designed to meet the stringent requirements of safety-critical applications.

Details include:

• I/O Scan Rate: The Fusion.IO system supports high-speed I/O scanning with a sampling rate of up to 8 kHz (8000 samples per second). This high-speed sampling ensures that inputs and outputs are processed with minimal delay.
• Cycle Time: The EtherCAT cycle times can be as low as 125 µs. This enables quick communication and response between the Fusion control module and the connected Remote Interface Modules (RIMs).
• Safety Interlock Logic: The Fusion Safety system can process safety interlocks and I/O logic rapidly, ensuring that any safety-related actions (such as triggering a shutdown or activating a safety valve) are executed promptly in response to input changes.

While the exact response time can vary based on the specific system configuration and the complexity of the safety logic, the system is designed for real-time performance, making it suitable for SIL 3 applications where fast, reliable response times are critical.

Typical Response Times:

• General System Response: In the range of <1 millisecond (depending on system configuration).
• Safety Functions: Safety functions, such as triggering emergency stops or activating safety circuits, typically operate in real-time with <1 millisecond delay, depending on the configuration.

The Fusion.IO system supports up to 255 interlock terms. This includes the capability to configure and implement a wide range of interlock logic for safety applications across the system’s I/O channels.
Details include:

• Interlock Terms: These are the logic elements that define the interlock conditions within the system. The system supports the creation of interlocks using software-defined logic that can be distributed across Fusion devices and Remote Interface Modules (RIMs).
• Safety Compliance: Fusion’s interlock logic can be implemented to meet ISO 61508, SIL 3 safety standards, ensuring that safety-critical conditions are properly managed and monitored.

User’s can program the Fusion safety logic using Fusion Interlock Builder™, which is part of the Fusion.IO system software suite. This tool allows users to design, simulate, and implement safety interlock logic that complies with ISO 61508, SIL 3 standards. Here’s how the process works:

Define the Safety Logic
In the Fusion Interlock Builder, create interlock logic using a variety of input and output channels. This includes selecting I/O types, configuring logic gates (AND, OR, etc.), and defining interlock conditions.

Safety interlocks are created based on system design requirements, and logic terms can be added to ensure safe operations across the entire Fusion system.

Program the Safety Interlocks
Program safety interlocks directly within the Interlock Builder. This involves assigning interlock terms, configuring timing (delays, etc.), and defining the safety states for each condition (e.g., triggering an emergency stop, activating safety alarms).

The tool also allows you to configure timing behaviors and delays associated with interlock conditions to ensure appropriate responses under various operational scenarios.

Simulate and Validate Logic
Once the interlock logic is configured, use the Simulation Mode to validate the safety logic before deploying it to hardware. This allows for testing the logic flow without needing a physical connection to the system.

Monitor Mode provides real-time diagnostics, allowing you to track the actual behavior of the interlocks during operation.

Download and Apply Logic
After programming and validating the logic, the safety logic is downloaded to the Fusion device for deployment. Users must ensure that the system is properly programmed and that the device is power-cycled to apply the changes.

Continuous Monitoring and Adjustment
Once deployed, users can monitor the system using the Fusion Interlock Builder to adjust the interlock logic, if necessary. The Fusion system supports real-time adjustments and provides feedback on the safety state of the system, which can be used to fine-tune the logic over time.

The Safety Temperature I/O Card in the Fusion.IO system is used for measuring and monitoring temperature in safety-critical applications, particularly those that must comply with IEC 61508 SIL 3 standards.

Details of the Safety Temperature I/O Card include:

• Temperature Monitoring in Safety Zones
  Allows direct input from temperature sensors (such as RTDs or thermocouples) to monitor equipment, enclosures, or processes where thermal conditions could pose a safety risk. Common use cases include overtemperature protection, equipment thermal shutdown, and environmental monitoring in semiconductor tools, industrial furnaces, or power electronics.
• SIL 3-Certified Safety Control
  Supports safety-rated temperature monitoring, enabling its use in safety interlocks that require compliance with SIL 3. For example, if a temperature exceeds a defined limit, the card can trigger a safe shutdown or prevent startup.
• Integration with Interlock Logic
  Inputs from the temperature card can be integrated into the Fusion Interlock Builder software to form part of the system’s safety logic. This allows for precise control based on real-time temperature conditions.

• Distributed I/O Support
  The card can be installed in either the Fusion controller or a Remote Interface Module (RIM), allowing temperature monitoring to be distributed close to heat-generating components for better accuracy and response time.

Yes, you can monitor interlock status while the Fusion system is running using the Monitor Mode in the Fusion Interlock Builder.

Monitor Mode – Key Features:

• Real-Time Status: Displays live interlock logic behavior during system operation.
• Active Logic Tracking: You can observe changes in interlock conditions and outputs as inputs change in real time.
• Hardware Required: This mode requires a connected and programmed Fusion device. The system must be power-cycled after any logic change for updates to take effect.
• Discrepancy Detection: The tool shows mismatches between the expected logic configuration and the actual hardware state, which helps in diagnosing issues.

Notes: Make sure the ILK file loaded in the Interlock Builder matches what is programmed on the Fusion device—otherwise, monitoring results may be inaccurate. If you want to test without hardware, you can use Simulation Mode instead.

Fusion.IO temperature slot cards are compatible with thermocouple (TC) or resistance temperature detector (RTD) sensing devices. Temperature readback measurements can be verified by comparing a known ‘sensed temperature’ readings issued by Fusion.IO using or DDI Studio EtherCAT software, or other approved EtherCAT software.  Familiarity with TCs and RTDs functionality is required so always consult their manufacturer’s user or application guide before performing a test. Connecting a TC directly to resistive heating elements will lead to unpredictable results and potentially cause damage to the slot card.

The Fusion.IO system is designed to handle 64 control loops, making it suitable for complex automation and safety-critical applications.

The system’s architecture allows for extensive control capabilities:

• High-Speed I/O Sampling: The system supports EtherCAT cycle times as low as 125 µs and a high-speed I/O scan rate of 8 kHz, enabling rapid processing of control loops.
• Modular Expansion: With the ability to connect up to four Remote Interface Modules (RIMs), each supporting up to 384 I/O points, the system can scale to manage a large number of control loops across distributed modules.
• Programmable Interlocks: The Fusion.IO platform includes TÜV-certified programmable interlocks, allowing users to define and manage control logic tailored to specific application needs.

Yes, the Fusion.IO system can continue to control temperature independently even if the EtherCAT Master is down, such as during a software upgrade.

Here’s how it works:

• Local Control Capability: Fusion supports local control loops, including temperature control, that are executed directly within the Fusion controller or RIMs. These functions do not depend on continuous communication with the EtherCAT Master to operate.
• Failsafe Behavior: During a loss of EtherCAT Master communication, safety interlocks and critical control functions (such as temperature regulation) can continue as long as they are configured to run locally on the Fusion system.
• Resilience Design: This feature is particularly important in high-availability applications where temperature control must be maintained even during planned maintenance or unexpected disconnections from the master.

Yes, Functional Safety will continue to work normally while the EtherCAT master is down, as long as the safety logic is configured and running locally within the Fusion system.

As of now, DDI does not offer an auto-tuning feature for PID loops or other control algorithms within the Fusion.IO system. The Fusion.IO platform provides the hardware infrastructure and safety-rated I/O modules necessary for implementing control systems, but it does not include built-in auto-tuning capabilities.

While auto-tuning is not available, users can manually configure and fine-tune control loops using the Interlock Builder™ software. This graphical tool allows for the design of safety interlocks and control logic, including PID loops, with precise control over parameters such as gains, setpoints, and deadbands. Users can adjust these parameters to achieve the desired system performance.

Interlock Builder™ is a safety control design environment where users can quickly and easily define safety interlocks and program them into their Fusion.IO system. These interlocks combine digital inputs and outputs distributed among connected Fusion and RIM devices and include logical objects such as:

• IO Ports
• Jump Tags (Cross Schematic connectors)
• Logic Gates: AND, OR, XOR, and Buffer
• Timers: ON, OFF, and Pulse
• Latches

Interlock Builder™ also provides tools to aid in the development and monitoring of interlock states. It includes mechanisms to prevent tampering with existing interlocks and features encryption of Interlock Builder project files to protect our customers’ proprietary information.

Yes, Interlock Builder™ can help you simulate and validate interlock logic via two key modes: Monitor Mode and Simulation Mode. Both modes help verify interlock functionality, but Simulation Mode is ideal for testing without hardware, while Monitor Mode reflects real-world behavior.

Simulation Mode lets you simulate logic without connecting to hardware and is useful for validating logic flow before deploying to hardware.

Monitor Mode, alternatively, allows you to view live interlock logic behavior on a connected Fusion device and displays actual I/O conditions. This is useful for troubleshooting and verifying system behavior on-the-fly.

Both of these modes highlight the schematic to describe the state of the input terms, intermediate gates, and output terms; yellow denotes a low signal and blue denotes a high signal. There is also a dockable pane, the Monitor View, that displays the status of input and output channels in either of these modes; this view allows for filtering channels by type and slot card location.

An interlock timer is used to add timing behavior—like delays—to logic gates in a circuit. It works by taking the output of a logic gate as its input and applying a timing function before producing the final output. This allows you to control when the gate’s output becomes active. The interlock timer options include an ON timer where it delays the signal’s rising edge, an OFF timer where it delays the signal’s falling edge, and a PULSE timer which only goes high for the set delay period. You can configure it by selecting a timer type and setting the delay period in the properties of the gate.

Yes, Interlock Builder™ requires a software license. It is proprietary software developed by Digital Dynamics, Inc. For detailed information regarding licensing options and pricing, contact a DDI Applications Engineer.

The Fusion.IO system supports up to 255 interlock terms. This includes the capability to configure and implement a wide range of interlock logic for safety applications across the system’s I/O channels.

• DIN IO Port: This is a physical reading from the real world on a DIN slot card. This acts as an input into Interlock Builder, and has squared edges.

• DOUT IO Port: This is a commanded state from the EtherCAT Master and can be set regardless of the state of the RIM. This means even if the RIM is offline, if the EtherCAT master commands the signal high, the IO port will be asserted. This acts as an input into Interlock Builder and has rounded edges.

• SOUT IO Port: This is the primary output IO port in Interlock Builder, and denotes the signal on the physical pin. It has interlock logic driving it and can be read back over EtherCAT in the input readback section of the corresponding module’s PDO. Because it denotes the physical pin’s state, if the RIM is offline or disconnected, the SOUT IO port will remain unasserted, even if the interlock logic is high. There is an option for this port to enable EtherCAT control, which requires the corresponding DOUT to be asserted (in addition to the interlock logic) in order to assert the SOUT signal.

Interlock files can be password-protected to prevent unauthorized editing of interlock logic or metadata. To apply protection, navigate to File → Protect … and set a password.

After the interlock logic has been developed and validated, the interlock file can be submitted to DDI. New units from the factory can then be programmed with the finalized interlock logic and production locked. Once a unit is production locked, the Interlock Builder can no longer be used to modify its interlock logic or metadata. This ensures the integrity of the configuration and prevents tampering in the field.

If updates or changes are required after production locking, DDI can provide support files to unlock and update the configuration as needed.

The digital I/O sampling/update rate of a Fusion system is 8 kHz. The analog sampling/update rate is 8kHz for 8-channel analog slot cards and 4 kHz for 16-channel analog slot cards. This means that all digital I/O channels and 8-channel analog slot cards are scanned/updated synchronously 8,000 times per second, allowing for high-speed, real-time data acquisition and control.

Fusion temperature measurement inputs have a sampling rate ranging from 2.63 Hz to 333 Hz, depending on the specific slot card and its configuration.

Fusion does not support real-time clock (RTC) functionality. However, the system clock on the Fusion device can be set with second-level precision via EtherCAT Main using object 0x2000.07.

The Fusion.IO system by Digital Dynamics, Inc. offers scalable I/O capabilities through its modular architecture, combining Fusion devices with Remote Interface Modules (RIMs). The total number of I/O channels supported depends on the specific Fusion model and the configuration of connected RIMs.

Fusion Device I/O Capacities

• Fusion24: Supports up to 384 internal I/O channels. When expanded with up to 4 RIMs, the total I/O capacity can reach 1,920 channels.
• Fusion12: Supports up to 192 internal I/O channels, expandable to 1,728 channels with 4 RIMs.
• Fusion8: Supports up to 128 internal I/O channels, expandable to 1,664 channels with 4 RIMs.

RIM I/O Capacities

Each RIM can be equipped with different numbers of I/O slot cards, affecting the total I/O capacity:

• RIM with 24 I/O slot-cards: Supports up to 384 internal I/O channels.
• RIM with 12 I/O slot-cards: Supports up to 192 internal I/O channels.
• RIM with 6 I/O slot-cards: Supports up to 96 internal I/O channels.

These configurations allow for flexible and scalable I/O setups to meet the specific needs of various applications.

Yes, Digital Dynamics, Inc. (DDI) offers standard Fusion and RIM systems that allow customers to customize the I/O mix while maintaining standardized connectors dedicated to each slot card. These pre-configured solutions are designed to address common industrial automation requirements and can be delivered more quickly than fully customized systems.

Safety interlocks are developed and approved by the customer for a specific product and part number. Once in production, the interlock configuration logic is factory-installed and cannot be modified in the field using Interlock Builder. This restriction ensures safe system operation and compliance with CE standards. In the rare event that a fielded system requires an interlock logic update, DDI can, upon customer request, provide the necessary files to unlock or update the logic via FOE (File over EtherCAT).

Fusion systems include a web-based interface called Fusion On-Board Diagnostics (FOBD) for system configuration and diagnostics. This powerful troubleshooting tool offers a real-time overview of the Fusion system’s configuration and operational status.

FOBD compares the expected configuration—based on the system’s design—with the actual live status, enabling users to quickly identify mismatches or configuration discrepancies.

The Diagnostics Page provides valuable insights into system health and performance. It displays key logs and status indicators collected from internal log files, helping users efficiently detect faults, error patterns, or system anomalies. Additionally, log files can be downloaded directly from the page, streamlining the process of analysis, troubleshooting, and technical support.

Fusion.IO temperature slot cards are compatible with thermocouple (TC) or resistance temperature detector (RTD) sensing devices. Temperature readback measurements can be verified by comparing a known ‘sensed temperature’ readings issued by Fusion.IO using or DDI Studio EtherCAT software, or other approved EtherCAT software.

Familiarity with TCs and RTDs functionality is required so always consult their manufacturer’s user or application guide before performing a test. Connecting a TC directly to resistive heating elements will lead to unpredictable results and potentially cause damage to the slot card.