Pizzato Elettrica Srl
via Torino, 1
36063 MAROSTICA (VI)
ITALY
e-mail: [email protected]
web site: www.pizzato.com
Phone: +39.0424.470.930
ZE FOG147B22-EU
4/18
1 INFORMATION ON THIS DOCUMENT
1.1 Function
The present operating instructions provide information on installation, connection and
safe use for the following articles:
CS MP312•0.
1.2 Target audience
The operations described in these operating instructions must be carried out by quali-
fied personnel only, who are fully capable of understanding them, and with the techni-
cal qualifications required for operating the machines and plants in which the safety
devices are to be installed.
1.3 Application field
These instructions apply exclusively to the products listed in paragraph Function, and
their accessories.
1.4 Original instructions
The Italian language version is the original set of instructions for the device. Versions
provided in other languages are translations of the original instructions.
2 SYMBOLS USED
This symbol indicates any relevant additional information
Attention: Any failure to observe this warning note can cause damage or mal-
function, including possible loss of the safety function.
3 DESCRIPTION
3.1 Device description
The safety device described in this manual is defined according to the Machinery
Directive 2006/42/EC as logic component for safety functions.
This multifunction safety module is used to implement safety functions such as emer-
gency stop monitoring, door or guard control, monitoring safety barriers, safety mats
or magnetic sensors on industrial machines. This device is particularly suitable for
controlling machines with a variety of combined safety functions (for example, simul-
taneous emergency stop and guard control), or machines with parts that have to be
isolated in normal operating conditions (to do maintenance for example).
3.2 Device functions
This multifunction safety module has many different inputs, which are evaluated by an
application program to activate safety or signalling outputs. To reach the highest levels
of safety, this device has a redundant and self monitoring structure with two proces-
sors that continuously check the system in a coordinated way. The module also has
numerous green LEDs that show the state of the inputs and outputs and two red/blue
LEDs (P1, P2) that show the state of the processors or any faults.
In the safe state, the safety outputs are switched off (safe power off).
The safety function performed by the module is set up and configured using the logical
blocks available in the Gemnis Studio configuration software, which is distributed as
freeware by Pizzato Elettrica and which must be installed on an external PC. A general
safety function can be defined as follows:
- the safety outputs are switched off within the specified reaction time if the result of
the programmable logic solver (application program) is negative or in the case of
errors.
On the basis of external device features and the circuit structure, with this module you
can obtain safety circuits up to:
- SIL 3 acc. to EN 62061;
- PL e acc. to EN ISO 13849-1:2015;
- safety category 4 acc. to EN ISO 13849-1:2015.
3.3 Intended use of the device
- The device described in these operating instructions is designed to be applied on
industrial machines.
- The direct sale of this device to the public is prohibited. Installation and use must be
carried out by qualified personnel only.
- The use of the device for purposes other than those specified in these operating
instructions is prohibited.
- Any use other than as expressly specified in these operating instructions shall be
considered unintended by the manufacturer.
- Also considered unintended use:
a) using the device after having made structural, technical, or electrical modifications
to it;
b) using the product in a field of application other than as described in paragraph
TEChNICAL DATA.
4 OPERATION
4.1 Definitions
- Application program: the part of the internal safety module software intended for the
customer's application.
- POwER ON: the safety module state, which lasts from the power on until the end of
the internal controls.
- RUN: the safety module state on completion of the POwER ON phase (if no errors
have been detected) in which the application program is run.
- ERROR: the safety module state when a fault is detected. In this state, the module
switches to the safe state, i.e., all safety outputs are deactivated.
- Fault: a fault can be internal or external to the safety module. Internal faults are
autonomously detected thanks to its redundant and self-monitored structure. An
external fault can be detected by the application program. It follows that the definition
of external fault is strictly dependent on the application (see note A).
4.2 Description of operation
when supplied with power, the module enters the POwER ON state and runs an inter-
nal self-diagnosis. In this phase, the two processor LEDs (P1, P2) remain illuminated
red for about 1 second. If the internal tests are completed without malfunction, the
two LEDs are switched off, the module enters the RUN state, and runs the application
program. If the start tests are not passed, the module enters the ERROR state and the
malfunction is indicated by the processor LEDs (P1, P2) remaining illuminated in red.
The green LEDs relating to the power supply and the module inputs are not controlled
by processors, and they immediately begin indicating the states of the respective in-
puts/outputs.
when the module is in the RUN state, and no faults are detected, the two LEDs (P1,
P2) remain switched off.
In the RUN state, the module can detect faults external to the module, for example
caused by short circuits, or invalid input states (see note A). Depending on the fault
type detected, the application program may place the module in ERROR state, to
indicate the malfunction. In this case, the application program can communicate an
error code by making the LEDs (P1, P2) flash in sequence.
During the Run state, simultaneously with application program execution, the module
constantly runs a series of internal tests to check for correct hardware operation. If a
malfunction is detected, the module state changes to ERROR.
Once in ERROR state, the module is placed in a safe condition, that is with all the
safety outputs open; the application program is no longer evaluated, and neither are
the system inputs. Furthermore, the semiconductor signalling outputs are left unal-
tered (changes in inputs do not affect them) at the value imposed by the application
program before entering the ERROR state. To reset the module, just switch it off for the
required duration (see technical data) and then switch it on again.
Note A:
A short circuit is not always a fault. For example, in the case of an ordinary push button for
emergency stops equipped with two NC contacts, contact opening is the signal to be evaluated and
a short circuit between the two contacts is a fault. In contrast, in the case of a safety mat with 4-wire
technology, the opposite is true, i.e. a short circuit between the wires is the signal to be evaluated
whereas wire interruption is a fault.
4.3 Wiring diagrams
4.3.1 Safe detection of rotating axes motion (up to 2 axes)
F1B
A4
F1A
CS MP312
•
0
A3
+
-
F2B
F2A
axis1
axis 2
LED F•A
LED F•B
Description
/
/
No supply voltage on the module.
green
green
Module starting phase
orange
orange
Internal tests upon start-up.
green
*
The sensor connected to terminal F•A has been detected as active.
*
green
The sensor connected to terminal F•B has been detected as active.
blinking
green
blinking
green
When the axes are rotating, LEDs F•A and F•B blink green with
the same frequency as the signal received at the proximity sensor
inputs, and the voltage detected at terminals A3-A4 is correct.
red / green,
alternating
red / green,
alternating
The voltage detected at terminals A3-A4 is not within the allowed
range (e.g.: terminal detachment, faulty sensors).
red
red
Internal board error.
Legend:
/ = off;
* = indifferent
- Only PNP-type proximity sensors can be used.
- The duty cycle of each cam must be such that at least one of the two sensors is
always active.
- To avoid sensor activation errors, adopt suitable assembly procedures to prevent
foreign bodies getting between the proximity sensors and the cams.
- Fit the two proximity sensors of the same axis so they are mechanically independent
of each other. This prevents a simultaneous failure of both sensors. Don’t fix both
sensors to the same bracket for example.
- To detect the direction of rotation, the two sensors of the same axis must be mounted
with an angle of less than 90°, while guaranteeing at least one sensor is always ac-
tive during axis rotation, as this requirement must be met. Suggested value: 30-50°.
- The direction of rotation of each axis must be checked on the machine to make sure
it is correct, as this depends to a great extent on:
- axis acceleration and angular velocity;
- the angular offset between the sensors;
- cam design (duty cycle);
- the reaction time of the sensors used.
