Mitsubishi Electric MELSEC iQ-R-R00CPU, User Manual

Page: 5 / 1028

3
[Design Precautions]
WARNING
● Especially, when a remote programmable controller is controlled by an external device, immediate
action cannot be taken if a problem occurs in the programmable controller due to a communication
failure. To prevent this, configure an interlock circuit in the program, and determine corrective actions
to be taken between the external device and CPU module in case of a communication failure.
● Do not write any data to the "system area" and "write-protect area" of the buffer memory in the
module. Also, do not use any "use prohibited" signals as an output signal from the CPU module to
each module. Doing so may cause malfunction of the programmable controller system. For the
"system area", "write-protect area", and the "use prohibited" signals, refer to the user's manual for the
module used.
●
If a communication cable is disconnected, the network may be unstable, resulting in a communication
failure of multiple stations. Configure an interlock circuit in the program to ensure that the entire
system will always operate safely even if communications fail. Failure to do so may result in an
accident due to an incorrect output or malfunction.
●
To maintain the safety of the programmable controller system against unauthorized access from
external devices via the network, take appropriate measures. To maintain the safety against
unauthorized access via the Internet, take measures such as installing a firewall.
[Precautions for using SIL2 Process CPUs]
●
When the programmable controller complies with IEC61508 SIL2 detects a fault in the external power
supply or itself, it turns off all outputs in the safety system. Configure an external circuit to ensure that
the power source of a hazard is shut off by turning off the outputs. Failure to do so may result in an
accident.
●
Configure short current protection circuits for safety relays and protection circuits, such as a fuse and
breaker, external to the programmable controller.
●
When a load current exceeding the rated current or an overcurrent caused by a load short-circuit
flows, modules which are operating in SIL2 mode detect an error and turn off all outputs. Note that if
the overcurrent state continues for a long time, it may cause smoke and fire. To prevent this, configure
an external safety circuit, such as a fuse.
●
When changing data and operating status, and modifying program of the running safety
programmable controller from an external device such as a personal computer connected to the SIL2
Process CPU, configure an interlock circuit in the program or external to the programmable controller
to ensure that the entire system always operates safely. In addition, before performing online
operations, determine corrective actions to be taken between the external device and SIL2 Process
CPU in case of a communication failure due to poor contact of cables.
●
Do not use any "use prohibited" signals in I/O signals to each module since they are used by the
system. Do not write any data to the "use prohibited" areas in the buffer memory of a module. For the
"use prohibited" signals, refer to the user's manual for the module used. Do not turn on or off these
signals on a program since normal operations cannot be guaranteed. Doing so may cause
malfunction of the programmable controller system.