Controller in accordance with safety category 4 based on EN 954-1
and SIL3 based on IEC 61508
English
PENDING
manufactured under ISO 9001: 2000
IMPORTANT NOTE
FOLLOW THE INSTRUCTIONS GIVEN IN THIS MANUAL CAREFULLY. FAILURE TO DO SO MAY CAUSE CUSTOMER COMPLAINTS AND SERIOUS CALL BACKS. KEEP INSTRUCTION MANUAL ON SITE.
The safety relays SafeCIS3
Maximum safety in minimum space The most compact genius!
5.1. Basic configuration ...................................3 6. Status outputs........................................ 4 7. LED display elements ............................ 5
10. Fault identification through LED ........... 9 10.1. Causes for internal faults ..........................9 10.2. Causes for external faults........................10
11. Selection tables ................................... 10 12. Accessories / Components................... 10 13. Inspection and service ........................ 11
15.1. Configuration Control Document ............13 16. Certificates .......................................... 14
16.1. CE Certificate .........................................14 16.2. TÜV Certificate .......................................15
1. Approvals and Conformity
The CE-declaration (see chapter 16.1) as well as the safety approval, performed by TÜV Rheinland Prod-uct Safety GmbH (see chapter 16.2) are available, from your nearest CEDES dealer or on our home-page at www.cedes.com. The actual list of relevant safety data and applied standards is given in these documents. All CEDES products are developed and manufac-tured according to state of the art technology and in compliance with a total quality management system ISO 9001: 2000.
Danger SafeCIS3 units can only achieve their function as a safety controller module, if the instructions given in this instruction manual and the within mentioned documents are exactly followed, as well as consul-ting the valid laws and regulations at the time of in-stallation. Should these instructions not be carefully followed, serious injury or death may occur. The installer or system integrator will be fully responsible for a safe integration of this product. This instruction manual is part of the controller mod-ule type SafeCIS3. It must be kept accessible to-gether with the other machine documentation during its entire life cycle for all personnel responsible for assembly, installation, operation and maintenance.
SafeCIS3 is a series of extremely compact safety controller modules. The main controlling module allows for the connection and control of the compact CEDES safety light curtain system Safe400 (Figure 1). Depending on the configuration, other safety components can also be connected and monitored simultaneously.
OptiLink
Extension moduleMain module
Figure 1: SafeCIS3 controller with all safety components which can be connected (depending on the individual configuration)
The main module offers two safety PNP outputs. Further extension modules are available for applica-tions which need contact outputs. These extension modules can be easy hooked on and connected to the main module.
2.1. Special features
The outstanding characteristics of the SafeCIS3 controller: Safety category 4 according to EN 954-1 SIL Level 3 according to IEC 61508 Short response times Modular extendible Up to 3 extension modules per main module Adjustable stop delay time Different safety components suitable for con-
nection
3. Applications
3.1. Typical applications
SafeCIS3 controller modules are developed and conceived for typical applications like:
Presses Robotic cells with automatic insertion Assembly lines Indexing tables Conveyor systems Automatic storage facilities
3.2. Application restrictions
SafeCIS3 controller modules are not intended for application in explosive (EX) or in radioactive envi-ronments.
4. Dimensions
The dimensions of the SafeCIS3 housing are illus-trated in Figure 2.
110
125
22.5
95111
Figure 2: Main module dimensions are the same for extension modules
5. Terminal connection diagram
5.1. Basic configuration
The following figures show the connection possibili-ties for the SafeCIS3 controller with the basic con-figuration. The logic of this basic version is exempli-fied in the accompanying Configuration Control Document (Figure 15):
Figure Safety component Start mode Start
releaseFigure 3 Safe400 manual no Figure 4 Safe400 manual yes Figure 5 Safe400 automatic no Figure 6 Safe400 automatic yes
Figure 7: SafeCIS3 controller and SafeCIS3 2C-extension mod-ule (basic configuration, automatic start, with start release)
6. Status outputs
The SafeCIS3 main module has two status outputs ("Info1" and "Info2"). The logic of these two outputs depends on the configuration. A description of these outputs is given in the Configuration Control Docu-ment as shown in Figure 15. The following table shows the logic of the two status outputs for the basic configuration. The state of the status outputs will also be displayed through LED, visible on the front side of the main module. Table 1:
Terminal (LED)
Output high (+24 V)
Output low (0 V)
Info1 (LED) Start ok (green)
No start possible (red)
Info2 (LED) System okay (green) Error (Lock out) (red)
Warning: Important safety advice These outputs may not perform any safety relevant functions. They serve only to communicate the status to a machine controller.
Table 2 gives information about the LED on the front side of a SafeCIS3 main control unit with the basic configuration:
Table 2: Basic Configuration
LED Signal / Color / Status
Signal / Color / status
Lamp - - GPIO4 +24 V / green /
automatic start 0 V / off /
manual start GPIO3 +24 V / green /
manual start signal high or automatic
start
0 V / off / manual start
GPIO2 - - GPIO1 - - OSSD2 +24 V / green /
Safe400 not activated
0 V / red / safe400 activated (e.g. interrupted)
OSSD1 +24 V / green / Safe400 not
activated
0 V / red / safe400 activated (e.g. interrupted)
Info2 (LED) See chapter 6 See chapter 6
Info1 (LED)
See chapter 6 See chapter 6
IN2 +24 V / green / start release okay
0 V / red / no start release
signal IN1 +24 V / green / no
test 0 V / red / test
0 V - -
+24 V +24 V / green / power connected
0 V / off / no power connected
8. Response time
In principal: The response time of a SafeCIS3 main module
depends on the configuration. The response time for the SafeCIS3 main module
with respect to the Safe400 light curtain t(mmLC) is different than the response time for the SafeCIS3 main module with respect to other safety components connected to the GPIO's t(mmGPIO). The standard maximum response times t(mmLC)
and t(mmGPIO) for the SafeCIS3 main module, are given in chapter 15. The exact maximum response times for the
SafeCIS3 main module, with respect to specific Safe400 light curtains t(mmLC), as well as a spe-cific safety components (tmmGPIO) may be found in the corresponding Configuration Control Docu-ment (e.g. Figure 15). The exact maximum response time of a SafeCIS3
extension module t(em) is only printed in the cor-responding Configuration Control Document (e.g. Figure 15).
The response time may further increase if a delay time t(delay) is configured for a safety component. No start impulse is accepted during the delay pe-riod. The safety outputs will switch off at the end of this delay period. The delay time of each config-ured safety component is printed in the corre-sponding Configuration Control Document (e.g. Figure 15).
The total response time of a CEDES "Safe400 / SafeCIS3 main and extension module" system, is the sum of each response time: Table 3: Calculation for the total response time of the Safe400 safety light curtain Response time Safe400 light curtain
See label of light curtain: t(LC)
Response time SafeCIS3-2P-4IO
See actual Configu-ration Control Document: t(mmLC) and t(delay)
Total response time of OSSD outputs: t(LC) + t(mmLC) + t(delay)
Response time first, 2nd and 3rd extension module
See actual Configu-ration Control Document: t(em)
Total response time of extension relay outputs: t(LC) + t(mmLC) + t(delay) + t(em)
Table 4: Calculation for the total response time of other safety components connected to the GPIO’s Response time safety component
See label of Safety component: t(SC)
Response time SafeCIS3-2P-4IO
See actual Configu-ration Control Document: t(mmGPIO) and t(delay)
Total response time of OSSD outputs: t(SC) + t(mmGPIO) + t(delay)
Response time first, 2nd and 3rd extension module
See actual Configu-ration Control Document: t(em)
Total response time of extension relay outputs: t(SC) + t(mmGPIO) + t(delay) + t(em)
The values given in chapter 15 are maximum values for the basic configuration. It might be that other special configurations have a longer or shorter maximum response time than given in chapter 15. Please contact your nearest CEDES partner for an individual clarification.
Important safety advice: If authorized personnel reconfigure the controller using the OptiLink, then depending on the configura-tion the response time t(mm) may be increased. So it is very important that after every new configuration
a. the actual configuration name is placed on the main module and
b. the new response time is conform with the limits given in the risk analysis of the machine.
For the professional installation and connection, please consult the relevant laws and regulations. The safety officer of the manufacturing facilities, the local authorities (OSHA in USA, HSE in GB) or the respective industry associations as well as the inten-sively trained employees of CEDES are available for any safety related queries.
The requirements of the safety regulations of electri-cal engineering, the local employer's liability insur-ance association and the international standard IEC 60204 are to be taken into full consideration.
In the following chapters the installation of all possi-ble safety components, which can in general be con-nected to a SafeCIS3 main module, is also de-scribed. Which safety component has to be con-nected to guarantee a faultless function is printed in the corresponding Configuration Control Document for the SafeCIS3 main module (e.g. Figure 15).
9.1. Mounting location
The SafeCIS3 modules must be mounted in a control cabinet which is sealed to at least IP54. The units must be snapped onto a 35 mm mounting rail, which is grounded. If it is used outside of a control cabinet a housing with a protection category of IP54 and a mounting rail capability is recommend. For operation temperature see chapter 15.
9.2. Cable and wires
The wires from the SafeCIS3 main module must be securely separated and guided away from the wires of the relay section (SafeCIS3 extension module). In order to decrease the effects of EMC disturbances shielded cables must be used for the safety compo-nents (chapter 9.8).
9.3. Supply voltage
To safeguard the controller, the +24 V terminal should be protected with an external 5 A fuse. The controller and the machine should be off-line before beginning the installation.
The supply voltage must conform to the require-ments of EN 60204-1, it must bridge a 20 ms inter-ruption of the supply network. When considering the supply voltage, it must be one of the following: SELV (Safety-Extra-Low-Voltage) or PELV (Protective-Extra-Low-Voltage) in accordance with IEC 364-4-41.
9.4. Earth connection
The earth of each SafeCIS3 module is realized through the connection to the mounting rail. Conse-quently it is important to ensure, that the mounting rail has a good earth connection.
9.5. Safe400 light curtain
The two RJ45 sockets on the lower portion of the main module are for the connection of CEDES safety light curtain Safe400 (white = E = emitter; blue = R = receiver). To protect the RJ45 connectors the cables have to be snapped into the provided cable holders.
9.6. Start mode
It is possible to configure the following start modes for the connected safety components:
- automatic start or - manual start.
For each start mode it will also be possible to config-ure a minimal safety output off time (see chapter 9.6.3). A description of which start mode is configured for which safety component is given in the correspond-ing Configuration Control Document (e.g. Figure 15).
For the basic configuration the distinction between automatic and manual start can also be managed without changing the configuration. In this case the selection can be done with the help of connecting +24 V to "GPIO3" and "GPIO4" (see Figure 3 - Figure 7).
9.6.1. Manual start
When each configured safety component reports "safety okay", depressing the start button will cause the two safety OSSD outputs to change from low to high and if connected the SafeCIS3 relay extension modules will close (= manual start). If more than one safety component is configured, then all components must report "safety okay" before a start is allowed.
The start button is monitored. This means, a short-circuit of the button will not lead to a start of the ma-chine. Pulse length manual start: min 50 ms / max. 5 sec. In case the start impulse is longer than 5 s the start is not accepted. The exact terminal to connect the start button to is given in the corresponding Configuration Control Document (e.g. Figure 15). If the Configuration Con-trol Document shows that the manual start must be attached to terminal In1 or In2, then the meaning of the respective LED is shown in Table 5 Table 5:
Terminal LED green LED red In1 or In2 No start signal
present Start signal present
(button pressed)
Important safety advice: It is fundamental that the start button be mounted so that the danger area is clearly visible. That is, when pressing the start button it must be guaranteed that no one is detained within the danger area.
9.6.2. Automatic start
If a safety component is configured for "automatic start", then, after the activation and the deactivation of the safety component, the two OSSD outputs will
change automatically from low to high again and if connected the SafeCIS3 extension relay blocks will automatically re-close.
Important safety advice: According to EN 60204 article 9.2.4.4.2 a system may not automatically restart, even after the cause of the shutdown has been eliminated and thereby an-other danger may still exist to the operator. If the SafeCIS3 unit is configured with an "automatic start", this requirement must be fulfilled by further meas-ures.
9.6.3. Minimum off time
According to the standard IEC 61496-2 a safety light curtain must have a minimum safety output off time of 80 ms. This means that even in the case of a very short safety light curtain interruption, the safety out-puts will stay low (Relays = open) during this mini-mum off time. During this minimum off time a start impulse is only accepted when all safety criteria stay fulfilled.
For each start mode it is also possible to increase the minimal safety output off time by reconfiguring the SafeCIS3 controller.
The minimal safety output off time for the basic con-figuration is set to 80 ms.
9.7. EDM or start release
Often a SafeCIS3 module is connected to external relays. Reasons to do this might be: The relays of the extension modules do not have enough contacts or if the required switching capacity is more than the specified capacity. These external relays can be connected a. to the two safety PNP outputs (OSSD) of the
main module (e.g. Figure 4) and / or b. to the contacts of an extension module, e.g. if
the power of the two OSSD outputs is not ade-quate (e.g. Figure 7).
In any case when using external relays the function of these external relays must be monitored. For category 4 contact extension, two external contac-tors, each with force guided contacts must be in-serted. For monitoring the function of these contac-tors, each relay block must have at least one nor-mally closed contact which is fed back in series to the corresponding terminal of the SafeCIS3 control-ler (e.g. Figure 7).
Two options are possible for this monitoring: 1. Start release: The signal at the corresponding
input terminal must be high before the start but-ton is pressed (this means: the normally closed contacts of the external relays must be closed before allowing a start).
2. EDM (external device monitoring): The input signal of the EDM terminal is always monitored. This means: not only at the beginning before a start the signal must be correct. Also after the start a signal change must happen, otherwise
an emergency stop occurs. In case the wrong signal is present for longer than 5 seconds a lock-out will occur.
The option "start release" can be realized with the basic configuration.
The option "EDM" can only be realized by reconfigur-ing the SafeCIS3 main module with the help of the OptiLink.
If the Configuration Control Document shows that EDM or start release must be attached to terminal In1 or In2, then the meaning of the respective LED is shown in Table 6
Table 6:
Terminal LED green LED red
EDM at In1 or In2
EDM signal okay EDM signal wrong
Start release at In1 or In2
Start release signal okay
Start release signal wrong
The start release or EDM input is not cross-fault monitored. Therefore the wiring of these inputs must be permanently installed, and protected against ex-ternal damage, according to EN ISO 13849-2 (i.e. cable channel, or armored conduit). Additionally, they must be realized within separate plastic-sheathed cables, as well as inside a protective en-closure. Prerequisite, is that both the wire and the protective enclosure fulfill the corresponding re-quirements (according to EN 60204-1).
Important safety advice: 1. In cases where the SafeCIS3 main module is
installed without extension modules the function external device monitoring (EDM) or start re-lease must always be realized, the only excep-tions are if the PNP outputs are connected with another safety relay or a safety PLC.
2. Through the use of start release or EDM, it is possible to switch external "power" contactors within the safety circuit. Such contactors often deal with large inductive loads, which during the switching off phase can create large potential peaks. For this reason surge suppressors are highly recommended. Surge suppressors must be connected parallel to the external contactors (e.g. Figure 1 and Figure 7). They may never be connected parallel to the contacts of a SafeCIS3 extension module.
It must be noticed, that surge suppressors may dras-tically increase the off delay time of the contactors. Diodes are not allowed to be used as surge sup-pressors, for exactly this reason. Recommended surge suppressors are:
Supply voltage [V] Resistor R [Ώ] Condenser C [µF] 24 100 2.2
The connected safety components (e.g. safety switches for securing doors, position switch, emer-gency stop button, a cable pull safety switch) must satisfy the relevant standards for application within safety areas:
Emergency stop button : EN 418 Safety switch : EN 60947-5-1, EN 954-1 Light curtains : EN 61496/-1 & /-2 etc.
as well as the requirements of the safety analysis. Essential is that the components contain 2 force guided, normally closed (NC) contacts (Figure 8), and that they are approved for the relevant safety level or category. As a basic rule to increase reliabil-ity, it is recommended to use safety components with integrated gold contacts.
To connect safety components, the four terminals "GPIO1" – "GPIO4" are available. The connections are short-circuit and cross fault monitored.
GPIO1
GPIO2
GPIO3
GPIO4
Figure 8: Connecting an emergency stop
In general the two circuits of dual channel safety components are cross-fault monitored. A connection of these two circuits would lead to an emergency stop (see chapter 10) of the SafeCIS3 main module. The two circuits are also time monitored. This means, if one circuit changes e.g. of an emergency stop, the second circuit has to follow within 5 sec-onds. If this is not the case, the SafeCIS3 interprets this as a fault and the controller switches off the safety circuit.
Depending on the configuration and depending on the application, there may be more safety compo-nents defined than necessary. In such a case it is sufficient to bridge the respective terminals of the missing components directly in the control cabinet. In order to decrease the effects of EMC disturbances shielded cables must be used. Furthermore a high number of connections within the cables to the safety components as well as poor contacts within the safety components may have an adverse effect on reliability.
Table 7:
Terminal LED green LED off GPIO3 Contact GPIO1/GPIO3
closed Contact GPIO1/GPIO3
open GPIO4 Contact GPIO2/GPIO4
closed Contact GPIO2/GPIO4
open
9.9. Safety Prevention
Certain applications require that at certain times safety components must be overridden (e.g. during installation). Specialists are familiar with different terms for this kind of overriding: Safety Prevention, Override or Bypass. Hereafter we will refer to this as "Safety Prevention".
In Figure 9 a "Safety Prevention" key switch and a safety prevention lamp is shown. With the "Safety Prevention" key switch it is possible to prevent the safety function of the Safe400 light curtain. This means that if the prevention key switch is activated, the safety outputs stay high even if e.g. the protec-tive field is interrupted.
GPIO1
GPIO2
GPIO3
GPIO4
Lamp + 24V
Figure 9: Connecting a Safety Prevention key switch and the associated lamp
Normally if a key switch is used, a safety prevention lamp must also be connected. In accordance with some regulations, the SafeCIS3 monitors the func-tion of these lamps. The connection for this safety prevention lamp is current controlled (see Technical Data chapter 15). This means, the current (I) of the individual lamp must remain between (Imin < I < Imax ). For this purpose, CEDES recommends: Safety pre-vention lamp 806 (chapter 12). The safety prevention lamp used has to fulfill the requirements of EN 61496 and has to be mounted close to the protective field and be clearly visible to the machine operator.
Safety Prevention only takes place when both cir-cuits are closed. Likewise safety prevention only takes place when both circuits were opened before becoming closed. A cross-fault will be detected and stop the Safety Prevention function from becoming activated.
After one of the circuits is opened, the amount of time until the safety function of a safety component is once again active is maximum the response time of the SafeCIS3 unit. If an application does not require a safety prevention lamp (only allowed after a safety evaluation corre-sponding to EN 292), then either
a. a resistor (1 kΩ / 2 W) may be connected be-tween +24 V and terminal "Lamp" or
b. the output "Lamp" may be configured as "current check not active"
Alternatively to a safety prevention key switch, it is possible to attach – depending on the application and the required safety analysis – so-called three-stage enable switch or two independent, safety posi-tion sensors.
Table 8:
Terminal LED green LED red GPIO3 Contact GPIO1/GPIO3
closed Contact GPIO1/GPIO3
open GPIO4 Contact GPIO2/GPIO4
closed Contact GPIO2/GPIO4
open
Table 9:
Terminal LED off LED orange Lamp Safety prevention
circuits opened Safety prevention
circuits closed
Important safety advice: 1. The use of the "Safety Prevention" function is
only allowed in applications, for which the risk analysis (EN 292 and EN 1050) permits for the prevention of a safety component. As a general rule, emergency stop buttons may never be pre-vented! The safety prevention key for this switch has to be stored securely, so that only author-ized personnel have access to this key.
2. The function "Safety Prevention" can not be understood as the function "Muting" which is specified as the temporary automatic suspension of a safety function in the standard IEC 61496-1 A.7! Additional requirements have to be fulfilled to realize the "Muting" function which are not de-scribed here.
9.10. Testing SafeCIS3
Important safety advice: The SafeCIS3 main module complies with safety category 4 based on EN 954-1. According to EN 954-1 the execution of the security function must be tested at regular intervals via higher level controllers. The frequency of this check is based on the results of threat and risk analyze of the machine (EN 292-1 and EN 1050). Furthermore the SafeCIS3 unit is certified according to SIL3 of IEC 61508. If neces-sary please contact your next CEDES partner to receive more information about the safety specific data. Normally the test input at the main module is con-nected to +24 V. If an external test is desired accord-ing to the risk analysis, a contact can be connected to In1. In case of operation in the modus "self test-ing" both OSSD outputs have to be connected sepa-rately to the safety circuit of the machine.
Following possibilities are available for connecting the input.
+24 V Input (In1)
+24 V Input (In1)
Figure 10: Connection possibilities for the input
The timing of test input is as follows (Figure 11):
Table 10: Timing during testing
Time Value in ms Response time to test signal t1 ≤ tR Time to test t2 > t1 Restart time after test t3 ≤ tR
Test input
OSSD 1 / OSSD 2
t2 t3t1
open
short circuited
Figure 11: Test timing diagram (minimum off time = see Con-figuration Control Document, e.g. Figure 15)
tR means the max response time of the total CEDES system (see chapter 8). In case of a test failure the status output "Info2" will provide a failure signal. For this reason the informa-tion output must be connected to the machine con-troller. After each test cycle the machine controller must check if the output "Info2" is high again (Info2 = + 24 V). If the status output remains low (Info2 = 0 V), an error has occurred and the machine controller should not allow the machine to restart, respectively must stop the machine immediately. Alternatively the machine controller can also check the output of the OSSD during such a test.
Table 11:
Terminal LED green LED red In1 or In2 External test signal
high External test signal low
(test running)
10. Fault identification through LED
10.1. Causes for internal faults
In the event of an internal fault condition, it will be indicated by one of the info outputs (if configured) and can be visually noticed in that the blue OptiLink LED (located on the side of a SafeCIS3 unit) is off. In this situation both safety outputs are low and the relays of the extension modules are open, and the controller unit is now in the so-called lock-out mode.
Two options exist to leave the lock-out mode: 1. Power up. If the fault is still present the con-
troller will again show the lock-out mode. 2. A start impulse longer than 10 s acts like a
power up.
10.2. Causes for external faults
Following an external fault, it must be checked which components could have led to this fault. For example in case of Figure 9: A non illuminated GPIO3 LED indicates that one channel of the safety prevention switch GPIO1 – GPIO3 is open. The following fault conditions will lead to an emer-gency stop or to a lock-out mode of a SafeCIS3 con-troller:
Table 12
No Fault profile Fault description Measures and Instructions
1 Short-circuit or no connection of the supply lines of config-ured safety compo-nent.
"GPIO3" / "GPIO4" LED illuminate not green al-though safety component is closed. Only one channel of a
two channel safety device is closed.
Check safety component
3 Safety outputs do not switch on even al-though all safety compo-nents are okay
EDM or Start release signal from external contactors are wrong
Check wiring and function of exter-nal contactors.
The following fault conditions will lead to a lock-out mode of a SafeCIS3 main module:
Table 13
No Fault profile
Fault description
Measures and Instructions
1 The connection to the Safe400 safety light curtain emitter or receiver is interrupted.
Check supply lines and connectors Possibly swap emitter and re-ceiver connections
2 Defect in the electron-ics of the Safe400 light curtain or the SafeCIS3 controller module.
Switch off + on controller unit. If continuously lit, contact your near-est CEDES part-ner.
3 Low voltage identifica-tion High voltage identifica-tion
The supply voltage is lower / higher than the permissi-ble voltage (< 0.85 UN, i.e. > 1.15 UN, + 5 % ripple).
4
Blue OptiL-ink LED off or if config-ured: "Info2 output = low and LED Info2" = red
Fault at one of the SafeCIS3 extension modules
Check internal bus connection cable. If okay, controller must be repaired.
The lock-out mode of a SafeCIS3 unit may be reset by one of two methods (see chapter 10.1). Further diagnosis possibilities are possible with the CEDES software Configuration Tool in combination with the OptiLink (see chapter 12). If the SafeCIS3 unit has a lock-out, the exact fault description can be determined with these tools. An exact description is available at any time after a lock-out, as long as the SafeCIS3 unit is still in the lock-out condition.
11. Selection tables
Table 14
CEDES Part number Controller / Extension type
104 794 SafeCIS3-2P-4IO
104 858 SafeCIS3-EXT-2C including extension cable
104 860 SafeCIS3-EXT-3C including extension cable
104 864 SafeCIS3-EXT-4C (= 2x SafeCIS3-EXT-2C including extension cable)
12. Accessories / Components
Table 15
CEDES Part number Description
Xxx xxx Blank configuration control label
301 983 Terminal strip block 6 pin
301 982 Terminal strip block 5 pin
301 981 Terminal strip block 4 pin
800 183 Software Configuration Tool
104 565 USB OptiLink
103 566 103 567 103 568
Safe400 Standard system Safe400 Cascade system Safe400 Perimeter system
103 496 Emergency Stop Button
103 498 Start button
103 497 Key switch
103 499 Safety prevention lamp 806
For further accessories please contact your nearest CEDES sales partner.
The SafeCIS3 modules are built electronically and do not need preventive maintenance
13.1. Inspections
The SafeCIS3 modules have to be tested periodi-cally – in accordance with valid regulations - by qualified and trained personnel to discover prohibited manipulations or unauthorized modifications.
13.2. Decommissioning
The SafeCIS3 modules can only be removed, when the machine or the equipment is shut down com-pletely and can no longer be operated without tools. If a controller has to be disposed, it can be simply dismantled. The separated materials can be recycled according to state of the art technology and corre-sponding regulations of the country it was used in.
14. Product labels
All the necessary safety information can be found on the product labels and the Configuration Control Label, which can be found on every controller mo-dule (example):
Cat.4 / SIL3
Figure 12: Product label SafeCIS3 main module the with basic configuration
Explanation of terminology Table 16
Lot-no Prod. date YYMMDD/ Order confirmation number/ Code of final inspection / Serial number
HW Hardware Version
Safety Level Cat. Safety category according to EN 954-1
Safety Level SIL Safety integrity level according to EN 61508
Power class Power supply
Temperature range Operating temperature range
OSSD Max. current available per OSSD out-put, at the listed voltage
B002
Figure 13: Example of a product label SafeCIS3 main module with a special configuration
All of the configuration information will also be found on the Configuration Control Document (Figure 15), which is included with the delivery of every SafeCIS3 main control module. Note: In the event that a SafeCIS3 main controller will be reconfigured by authorized personnel using an Op-tiLink, a new Configuration Control Label must be printed, and applied over the existing label (Figure 14). Details of the new configuration are given in the Configuration Control Document.
New Name
Cat.4 / SIL3
Figure 14: Product label of a basic SafeCIS3 main module which was reconfigured. The new special configuration identification "New name" is positioned on the existing label.
