Mitsubishi Electric MELSEC iQ-R-R00CPU, Руководство пользователя

Страница: 6 / 1028

4
[Design Precautions]
WARNING
● Modules operating in SIL2 mode turn off outputs when they detect an error on the safety
communication path. However, the program does not automatically turn off outputs. Create a program
that turns off outputs when an error is detected on the safety communication path. If safety
communications are restored with outputs on, connected machines may suddenly operate, resulting
in an accident.
●
Create an interlock circuit which uses reset buttons so that the system does not restart automatically
after executing safety functions and turning off outputs.
●
In the case of a communication failure in the network, the status of the error station will be as follows:
(1) All inputs from remote I/O stations are not refreshed.
(2) All outputs from remote I/O stations are turned off.
Check the communication status information and configure an interlock circuit in the program to
ensure that the entire system will operate safely. Failure to do so may result in an accident due to an
incorrect output or malfunction.
●
Outputs may remain on or off due to a failure of output modules which are operating in SIL2 mode.
Configure an external circuit for monitoring output signals that could cause a serious accident.
[Precautions for using Safety CPUs]
● When the safety programmable controller detects a fault in the external power supply or itself, it turns
off all outputs in the safety system. Configure an external circuit to ensure that the power source of a
hazard is shut off by turning off the outputs. Failure to do so may result in an accident.
●
Configure short current protection circuits for safety relays and protection circuits, such as a fuse and
breaker, external to the safety programmable controller.
●
When a load current exceeding the rated current or an overcurrent caused by a load short-circuit
flows, the CC-Link IE Field Network remote I/O module (with safety functions) detects an error and
turns off all outputs. Note that if the overcurrent state continues for a long time, it may cause smoke
and fire. To prevent this, configure an external safety circuit, such as a fuse.
●
When changing data and operating status, and modifying program of the running safety
programmable controller from an external device such as a personal computer connected to the
Safety CPU, configure an interlock circuit in the program or external to the safety programmable
controller to ensure that the entire system always operates safely. In addition, before performing
online operations, determine corrective actions to be taken between the external device and Safety
CPU in case of a communication failure due to poor contact of cables.
●
Do not use any "use prohibited" signals as a remote I/O signal since they are used by the system. Do
not write any data to the "use prohibited" areas in the remote register. For the "use prohibited" signals,
refer to the MELSEC iQ-R CC-Link IE Field Network User's Manual (Application). Do not turn on or off
these signals on a program since normal operations cannot be guaranteed. Doing so may cause
malfunction of the programmable controller system.
● When the CC-Link IE Field Network remote I/O module (with safety functions) detects a CC-Link IE
Field Network error, it turns off outputs. However, the program does not automatically turn off outputs.
Create a program that turns off outputs when a CC-Link IE Field Network error is detected. If CC-Link
IE Field Network is restored with outputs on, connected machines may suddenly operate, resulting in
an accident.