© 2016 Cop
yr
ight Pizzato Elettr
ica - tr
anslation of the or
iginal instr
uctions
ZE_FOG118A16-IE
Pizzato Elettrica srl
via Torino, 1
36063 MAROSTICA (VI)
ITALY
e-mail: [email protected]
web site: www.pizzato.com
Phone: +39.0424.470.930
Fax:
+39.0424.470.955
art. CS MP208M0
5 TERMINALS LAYOUT
PWR
OS1 OS2
I21 I22
OS3 OS4
OS5 OS6 OS7 OS8
I25 I26
P2
P1
I11 I12
I15 I16
I23
I27
I13
I17
I24
I28
I14
I18
I25
I27 I28
I26
I21
I23 I24
I22
I15
I17 I18
I16
I11
I13 I14
I12
T01
T03 T04
T02
A1 A2 24V 0V
CS MP208
USB
OS1 OS2 OS3 OS4
OS5 OS6 OS7 OS8
2 WARNINGS
4 MAIN FUNCTIONS
- This a complex device made to implement safety related functions to protect people
and machines. The achievement of the target safety function depends on this device
hardware and software, the external devices, the external circuit structure and the
assembling of them all. For these reasons the installation and commissioning of this
device should be carried out only by professional workers which have appropriate
electronic knowledge.
- This device have to be installed and used only if this technical instructions sheet and
all the currently appropriate safety standards relevant for the application are well
known and implemented.
- This device are not intended for the private consumer as in the sense of EU directive.
- Before any kind of operation on the device (cabling, disconnecting the loads, settings
when appropriate) it should be checked that this device is disconnected from power
supply.
- Check that the safety module does not show evidence of damage suffered during the
transport or incorrect storage.
- The improper use of the safety module can lead to hazardous situation.
- Do not open the housing or undertake any unauthorized modifications of the product.
- In case of low demand applications (e.g. emergency stop) verify module safety func-
tion at least once a year.
This multifunction module is used to implement safety-related functions such as
emergency-stop monitoring, gates and guards monitoring and monitoring functions
using safety mats and magnetic sensors in machines with movable components. This
device is especially suited for control machines that require several safety functions
(i.e. emergency-stop and a protective door control) and operating machines having
components which must be switched off during operation (i.e. for servicing).
1 INTRODUCTION
Application Program: Part of this device internal software which is (customer) application
oriented. The Application Program is only a part of the device software which is required
to control the correct working of the device itself.
Power On state: The state of this device that lasts from the power-on of the module to
the end of internal self-check.
Normal Operation state: The state of this device after Power On State while no
Malfunctions have been detected
Error State: The state of the device when a Malfunction has been detected.
Malfunction: May be internal or external. Internal malfunctions are self-detected by the
device. An external malfunction is detected by the Application Program and consequently
what is a Malfunction and what is not is strictly application dependant (see note A).
3 DEFINITIONS
This multifunction module is provided with some inputs which are evaluated by an
Application Program software which actuates some outputs. To achieve the indicated
safety category this device has a redundant and self-controlled structure with two
processors that monitor each other. Many green LEDs are present to show the input
and output state and two red/blue LEDs show the processors status or detected errors.
Safe state corresponds to the safety output channels being in the off state (safe power
off).
Safety Function implemented by module is defined and configured by means of a high
level tool running on a personal computer. General safety function could be defined
as follows:
- Safety outputs are turned off within reaction time if the programmable logic solver
output (Application Program) is negative or errors are present.
CS MP
•••
Gemnis modules are programmable using a dedicated engineering tool
Gemnis Studio, freely available from www.gemnis.com.
Depending on the software and the external devices with this multifunction module it is
possible to made a safety circuits that can achieve a:
• SIL 3 according to EN 62061
• PLe according to EN ISO 13849
• Safety category 4 according to EN ISO 13849-1
6 OPERATION
When the supply voltage is switched on the device enters in the Power-on State and
the module checks itself. In this phase the two processors LEDs (P1, P2) stay red for
about 1 seconds. If internal check is passed the two LEDs are switched off and the
device enters in Normal Operation State and start evaluating the Application Program.
If check is not passed the device enters in Error State and processors red LEDs start
blinking, the number of blinking indicating an error codes for each processors (see table).
The green LEDs indicating power supply and inputs are not controlled by processors
and after power supply they start immediately indicating the relevant input/output state.
When safety module is working without any error in the Normal Operation State the two
LEDs (P1, P2) of processors are switched off.
In Normal Operation State the device may intercept some external circuit Malfunctions
due to short circuits, invalid circuit opening or incorrect status of the inputs (see note
A). Depending on the Application Software this Malfunction may lead the module to put
itself in the Error State. When it is in the Error State the safety module reports an error
code with a blinking sequence on the processors LEDs (P1, P2).
In Normal Operation State the safety module may also identify some internal problems
(memory errors, program errors, hardware errors, processor errors, …) and put itself
in the Error State.
In the Error State the device put itself in a safe state with all the safety output open and
no evaluation of the input signals and Application Program is performed anymore. In
Error State the signalling outputs remain fixed (changes of the inputs do not lead to a
change of the outputs) and their value is set-up by Application Software before entering
in Error State. To reset the device it is necessary to switch off the power supply for a
requisite time (see technical data) and then switch it on again.
Note A:
A short circuit is not always a Malfunction. For instance in a normal emergency
stop button with 2 NC contacts, an opening of the contacts is the signal to be evaluated
and a short circuit is a malfunction. Instead in a safety mat with 4 wires technology
the situation is opposite and short circuits is the signal that have to be evaluated while
opening of the wires is the Malfunction.
8 INSTALLATION AND COMMISSIONING
- See 2 WARNINGS
- Every time before installation, maintenance or wirings check that this device is
disconnected from power supply.
- Strong ESD may damage components of this device. Before touching the device
discharge your static electricity (for instance by touching a ground wire).
- The safety module should be installed and fixed in a 35 mm standard mounting rail
complying with EN 50022, inside an electric panel with adequate IP level.
- Verify that the safety module is used inside the operating ranges.
- Install appropriate fuse in series to each relay contact output to avoid the contacts
sticks (applies to relay output versions only).
- It is advisable to power the safety module with a separate source respect to the power
supply of machine and keep separate the wiring connections of the module from the
wiring of main power line.
- Power for the safety system and input circuits must always be provided from a single
power supply. The power supply must conform to the protective extra low voltage
regulations (SELV, PELV) with safe isolation.
- Verify that the tension of the power supply is correct before switch on the device.
- If expansion modules or external contactors are used, check that their contacts are
forcibly guided and install in feedback function one contact NC for each device (see
examples).
- The safety category, according to EN ISO 13849-1, achieved by the system including
the safety module, depends also on the external circuit.
- The plug-in connection terminals on the relay outputs may carry mains voltage and
should only be connected and disconnected when the voltage is switched off.
- Verify the correct operation of the whole system before putting it in service.
7 SIGNALLING
Power
Led
P1 and P2
Led
Possible failure
Off
Off
Fail of power supply to safety module, wrong connection, power wires cut
down, breakdown of external fuses.
Failure of safety module.
Green
Off
Normal operation.
Green
Red
Not recoverable fault.
Suggested action: Try to restart the module. If the fault persists, send back
the device for repair.
Green
Red x 1
Blue x 1
Recoverable fault: Overcurrent on Tx or Ox
Suggested action: Disconnect the signalling outputs (Ox), or test outputs
(Tx) and check for external short circuit.
Green
Red x 1
Blue x 2
Recoverable fault. A problem has been detected on OSx (ground short
circuit, or power supply short circuit or short circuit between two OSx).
Suggested action: Disconnect the safety output OSx and check for
external short circuit.
Green
Red x 1
Blue x 3
Recoverable fault. Safety module temperature outside limits.
Suggested action: Take back the temperature inside the admissible range.
Green
Red x 1
Blue x 4
Recoverable fault. Lack of power supply to 24V-0V clamps.
Suggested action: Check the wiring
Green
Blue x N
The application program has forced the module in error state with error
code N. Typically because of a detected fault condition on the inputs (i.e.
external short circuits, external not allowed state).
Suggested action: Disconnect the inputs and check for external short
circuit. Check the documentation of the Application Program for more
details.
