Pizzato Elettrica Srl
via Torino, 1
36063 MAROSTICA (VI)
ITALY
e-mail: [email protected]
web site: www.pizzato.com
Phone: +39.0424.470.930
ZE FOG142B22-EU
4/18
1 INFORMATION ON THIS DOCUMENT
1.1 Function
The present operating instructions provide information on installation, connection and
safe use for the following articles:
CS MP311•0.
1.2 Target audience
The operations described in these operating instructions must be carried out by quali-
fied personnel only, who are fully capable of understanding them, and with the techni-
cal qualifications required for operating the machines and plants in which the safety
devices are to be installed.
1.3 Application field
These instructions apply exclusively to the products listed in paragraph Function, and
their accessories.
1.4 Original instructions
The Italian language version is the original set of instructions for the device. Versions
provided in other languages are translations of the original instructions.
2 SYMBOLS USED
This symbol indicates any relevant additional information
Attention: Any failure to observe this warning note can cause damage or mal-
function, including possible loss of the safety function.
3 DESCRIPTION
3.1 Device description
The safety device described in this manual is defined according to the Machinery
Directive 2006/42/EC as logic component for safety functions.
This multifunction safety module is used to implement safety functions such as emer-
gency stop monitoring, door or guard control, monitoring safety barriers, safety mats
or magnetic sensors on industrial machines. This device is particularly suitable for
controlling machines with a variety of combined safety functions (for example, simul-
taneous emergency stop and guard control), or machines with parts that have to be
isolated in normal operating conditions (to do maintenance for example).
3.2 Device functions
This multifunction safety module has many different inputs, which are evaluated by an
application program to activate safety or signalling outputs. To reach the highest levels
of safety, this device has a redundant and self monitoring structure with two proces-
sors that continuously check the system in a coordinated way. The module also has
numerous green LEDs that show the state of the inputs and outputs and two red/blue
LEDs (P1, P2) that show the state of the processors or any faults.
In the safe state, the safety outputs are switched off (safe power off).
The safety function performed by the module is set up and configured using the logical
blocks available in the Gemnis Studio configuration software, which is distributed as
freeware by Pizzato Elettrica and which must be installed on an external PC. A general
safety function can be defined as follows:
- the safety outputs are switched off within the specified reaction time if the result of
the programmable logic solver (application program) is negative or in the case of
errors.
On the basis of external device features and the circuit structure, with this module you
can obtain safety circuits up to:
- SIL 3 acc. to EN 62061;
- PL e acc. to EN ISO 13849-1;
- safety category 4 acc. to EN ISO 13849-1.
3.3 Intended use of the device
- The device described in these operating instructions is designed to be applied on
industrial machines.
- The direct sale of this device to the public is prohibited. Installation and use must be
carried out by qualified personnel only.
- The use of the device for purposes other than those specified in these operating
instructions is prohibited.
- Any use other than as expressly specified in these operating instructions shall be
considered unintended by the manufacturer.
- Also considered unintended use:
a) using the device after having made structural, technical, or electrical modifications
to it;
b) using the product in a field of application other than as described in paragraph
TEChNICAL DATA.
4 OPERATION
4.1 Definitions
- Application program: the part of the internal safety module software intended for the
customer's application.
- POwER ON: the safety module state, which lasts from the power on until the end of
the internal controls.
- RUN: the safety module state on completion of the POwER ON phase (if no errors
have been detected) in which the application program is run.
- ERROR: the safety module state when a fault is detected. In this state, the module
switches to the safe state, i.e., all safety outputs are deactivated.
- Fault: a fault can be internal or external to the safety module. Internal faults are
autonomously detected thanks to its redundant and self-monitored structure. An
external fault can be detected by the application program. It follows that the definition
of external fault is strictly dependent on the application (see note A).
4.2 Description of operation
when supplied with power, the module enters the POwER ON state and runs an inter-
nal self-diagnosis. In this phase, the two processor LEDs (P1, P2) remain illuminated
red for about 1 second. If the internal tests are completed without malfunction, the
two LEDs are switched off, the module enters the RUN state, and runs the application
program. If the start tests are not passed, the module enters the ERROR state and the
malfunction is indicated by the processor LEDs (P1, P2) remaining illuminated in red.
The green LEDs relating to the power supply and the module inputs are not controlled
by processors, and they immediately begin indicating the states of the respective in-
puts/outputs.
when the module is in the RUN state, and no faults are detected, the two LEDs (P1,
P2) remain switched off.
In the RUN state, the module can detect faults external to the module, for example
caused by short circuits, or invalid input states (see note A). Depending on the fault
type detected, the application program may place the module in ERROR state, to
indicate the malfunction. In this case, the application program can communicate an
error code by making the LEDs (P1, P2) flash in sequence.
During the Run state, simultaneously with application program execution, the module
constantly runs a series of internal tests to check for correct hardware operation. If a
malfunction is detected, the module state changes to ERROR.
Once in ERROR state, the module is placed in a safe condition, that is with all the
safety outputs open; the application program is no longer evaluated, and neither are
the system inputs. Furthermore, the semiconductor signalling outputs are left unal-
tered (changes in inputs do not affect them) at the value imposed by the application
program before entering the ERROR state. To reset the module, just switch it off for the
required duration (see technical data) and then switch it on again.
Note A:
A short circuit is not always a fault. For example, in the case of an ordinary push button for
emergency stops equipped with two NC contacts, contact opening is the signal to be evaluated and
a short circuit between the two contacts is a fault. In contrast, in the case of a safety mat with 4-wire
technology, the opposite is true, i.e. a short circuit between the wires is the signal to be evaluated
whereas wire interruption is a fault.
4.3 Wiring diagrams
4.3.1 Safe detection of an analogue signal
Diagram with 2-wire sensors
Diagram with 3-wire sensors
C2
A4
C1
CS MP311
•0
A3
+
-
CS MP311
•0
C2
A4
C1
A3
+
-
LED CH A LED CH B LED C1
LED C2
Description
/
/
/
/
No supply voltage on the module.
green
green
green
green
Module starting phase.
orange
orange
orange
orange
Internal tests upon start-up.
/
/
green
green
Normal operation, input channels active.
red /
green
alternat-
ing
red /
green
alternat-
ing
red /
green
alternat-
ing
red /
green
alternat-
ing
Input channels C1/C2 cannot be detected as there
is no power on terminals A3/A4 or due to a measur-
ing stage fault.
red
red
red
red
Internal board error.
4.4 Increase of number and load capacity of contacts
If necessary the number and the load capacity of output contacts can be increased by
using external contactors with forcibly guided contacts
Feedback circuit for external contactors
with automatic start
Feedback circuit for external contactors
with manual or monitored start
K8
K7
K7
K8
F
-
+
Tx
Ix
24 Vdc
OS1
OS2
K8
K7
K7
K8
F
-
+
Tx
Ix
24 Vdc
OS1
OS2
In order to function correctly, any modules or PLCs connected to the OSx safety elec-
tronic outputs must be able to withstand cyclical deactivation tests performed on the
same.
