Notes for operation with safe control systems 10
Devices for direct connection to IP65 field modules 10
Safety in case of faults 11
Fuse protection for power supply 11
Requirements for connection cables 11
Connector assignment and wire color for safety switch CES-AP-C.2-CH 12
Connection 13
Connecting a CES-AP-...-SB-... (pin 5 not assigned) to a decentralized peripheral system
(e.g. ET200pro series from Siemens) 14
Setup 15
LED indicators 15
Initial setup 15
Functional check 15
System status table 16
Technical data 17
Technical data for safety switch CES-AP-CR2-CH/CES-AP-CL2-CH 17
Technical data for actuator CES-A-BLN-... 19
Technical data for actuator CES-A-BDN 21
This document is valid for all safety switches CES-AP-C.2-CH with version number
V 1.1.2 or higher.
Correct use
The Coded Electronic Safety switches of series CES are safety devices for monitoring movable safety guards.
In combination with a separating safety guard and the machine control, this safety
component prevents dangerous machine movements from occurring while the
safety guard is open. A stop command is triggered if the safety guard is opened
during the dangerous machine function.
Before safety switches are used, a risk assessment must be performed on the
machine, e.g., in accordance with:
Ì EN ISO 13849-1, Safety of machinery. Safety related parts of control systems.
General principles for design
Ì EN ISO 12100, Safety of machinery – General principles for design – Risk as-
sessment and risk reduction.
Important:
Ì IEC 62061, Safety of machinery. Functional safety of safety-related electrical,
electronic and programmable electronic control systems.
Correct use includes compliance with the relevant requirements for installation
and operation, for example
Ì EN ISO 13849-1, Safety of machinery. Safety related parts of control systems.
General principles for design
Ì EN 1088, Safety of machinery. Interlocking devices associated with guards.
Principles for design and selection
Ì EN 60204-1, Safety of machinery. Electrical equipment of machines. General
requirements
Ì EN 60947-5-3, Specification for low-voltage switchgear and controlgear. Con-
trol circuit devices and switching elements. Requirements for proximity devices
with defined behavior under fault conditions
The safety switch must be used only in conjunction with the designated CES actuators from EUCHNER. On the use of different actuators, EUCHNER provides no
warranty for safe function.
Ì The user is responsible for the integration of the device into a safe overall
system. For this purpose, the overall system must be validated, e.g. in accordance with EN ISO 13849-2.
Ì In the estimation of the PL for the overall system, a maximum value of
100 years can be assumed for the MTTFd according to the limit value in
EN ISO 13849-1:2008, section 4.5.2. This corresponds to a minimum value
for the PFHd of 2.47x10-8/h.
Ì Correct use requires observing the permissible operating parameters (see
Technical data).
Ì If a product data sheet is included with the product, the information on the
data sheet applies in case of discrepancies with the operating instructions.
Ì Only components may be used that are permissible in accordance with the
In case of failure to comply with the conditions for correct use stated above, or
if the safety instructions are not followed, or if any servicing is not performed as
required, liability will be excluded and the warranty void.
Safety switches fulfill personal protection functions. Incorrect installation or tampering can lead to fatal injuries to personnel.
Check the safe function of the safety guard particularly
Ì after any setup workÌ after the replacement of a CES componentÌ after an extended period without useÌ after every fault
Independent of these checks, the safe function of the safety guard should be
checked at suitable intervals as part of the maintenance schedule.
Warning!
Danger of fatal injury in the event of incorrect connection or incorrect use.
Ì Safety switches must not be bypassed (bridging of contacts), turned away,
removed or otherwise rendered ineffective.
On this topic pay attention in particular to the measures for reducing the possibility of bypassing from EN 1088:1995+A2:2008, Section 5.7.
Important:
The device is only allowed to be installed and placed in operation by authorized
personnel
Ì who are familiar with the correct handling of safety components Ì who are familiar with the applicable EMC regulationsÌ who are familiar with the applicable regulations on health and safety and ac-
cident prevention
Ì who have read and understood the operating instructions.
Prior to use, read the operating instructions and keep these in a safe place.
Ensure that the operating instructions are always available during mounting,
setup and servicing work. EUCHNER cannot provide any warranty in relation to
the readability of the CD for the storage period required. For this reason you
should archive a printed copy of the operating instructions. You can download
The device complies with the following safety requirements:
Ì Safety category 4, PLe according to EN ISO 13849-1Ì Redundant design of the circuit in the unit with self-monitoringÌ This means that the safety system still functions even if an internal component
fails
Ì The switch state of the semiconductor outputs is continuously monitored inter-
nally
Ì Short circuit detection at the safety outputs by pulse signals
The following switch-on condition applies to safety outputs OA and OB (see also
System status table and the section Typical system times):
Ì Safety guard closed
The system consists of the following components: coded actuator (transponder)
and switch.
Every EUCHNER actuator supplied has an electronic coding (unique coding) that is
read by the read head. Only if a correct coding is detected does the system accept
the actuator. The code in an actuator cannot be reprogrammed.
Unlike systems with unique code detection, on the CES-AP-C.2-CH a specific code is
not polled but instead it is only checked whether the actuator is of a type that can
be detected by the system (multicode detection). There is no exact comparison of
the actuator code with the code defined in the safety switch (unique code detection).
The safety switch is fastened to the fixed part of the safety guard.
The actuator attached to the movable part of the safety guard is moved towards
the read head fitted in the safety switch by closing the door. When the switch-on
distance is reached, power is supplied to the actuator by the read head by induction and data can be transferred.
If a permissible code is detected, the safety outputs are released.
Due to the combination of dynamic polling of the actuator and the redundant,
diverse design of the safety electronics with the two feedback safety outputs, the
safety switch will enter the safe state with every detectable fault.
When the safety guard is opened, the safety outputs switch off the safety circuit
and the monitoring output OUT is switched off. The state of the safety outputs is
monitored internally by two microprocessors.
If faults are detected, the safety circuit is switched off and the DIA LED illuminates.
In case of devices with a DIA monitoring output, the output is switched on.
The safety switch has a redundant circuit design with self-monitoring. This means
that the safety system is still effective even if a component fails.
The system is designed so that failures will not result in the loss of the safety function. The occurrence of failures is detected by cyclic self-monitoring at the latest
on the next demand to close the safety contacts (e.g. on starting).
If the safety door with the actuator should settle over time, the actuator can drift
out of the read head operating distance. The device recognizes this and indicates
that the actuator is in the boundary area (function available for V 1.1.2 and higher).
This allows the safety door to be readjusted in time.
Risk of damage to equipment as a result of incorrect installation. Safety switches
must not be used as a mechanical end stop.
Ì Fit an additional end stop for the movable part of the safety guard.
Important:
Ì From the assured switch-off distance S
down.
, the safety outputs are safely shut
ar
Ì When mounting several safety switches, observe the stipulated minimum
distance to avoid mutual interference.
Installation options
min. 400 mm
Ì The operating distance changes during the mounting of the actuator as a
function of the material used for the safety guard. Observe arrow direction
on the device (see figure below).
Permissible approach directions
Note the following points:
Ì Actuator and safety switch must be easily accessible for inspection and re-
placement.
Ì The switching operation must only be triggered by the specific actuator desig-
nated for this purpose. For permissible combinations please see the table of
possible combinations on page 4.
Ì Actuator and safety switch must be fitted so that
Ì the front faces are at the minimum switch-on distance 0.8 x S
when the safety guard is closed (see section Operating distances). A minimum distance dependent on the actuator must be maintained for a side approach direction: - for CES-A-BLN-R2 6 mm
- for CES-A-BLN-L2 6 mm
- for CES-A-BLN-U2 6 mm
- for CES-A-BDN 10 mm
Ì when the safety guard is open up to the distance S
tance), a hazard is excluded.
(assured switch-off dis-
ar
or closer
ao
Ì the actuator is positively mounted on the safety guard, e.g. by using the
safety screws included.
Ì Pay attention to the maximum tightening torque for the safety switch and
In case of an error, loss of the safety function through incorrect connection.
Ì To ensure safety, both safety outputs (OA and OB) must always be evaluated.Ì The monitoring output OUT must not be used as a safety output.Ì Lay the connection cables with protection to prevent the risk of short cir-
cuits.
Caution!
Risk of damage to equipment or malfunctions as a result of incorrect connection.
Ì The device generates its own clock signal on the output lines OA/OB. A
downstream control system must tolerate these pulses, which may have a
length of up to 0.4 ms.
No pulses are output when the safety outputs are switched off.
Ì The inputs on an evaluation unit connected must be positive-switching, as the
two outputs on the safety switch deliver a level of +24 V in the switched-on
state.
Ì All the electrical connections must either be isolated from the mains supply
by a safety transformer according to IEC 61558-2-6 with limited output voltage in the event of a fault, or by other equivalent isolation measures (PELV).
Ì For use and operation as per the requirements, a power supply with the
feature "for use in class 2 circuits" must be used. The same requirement applies to the safety outputs.
Alternative solutions must comply with the following requirements:
a) Electrically isolated power supply unit with a max. open-circuit voltage of 30
V/DC and a limited current of max. 8 A.
b) Electrically isolated power supply unit in combination with fuse as per UL248.
This fuse should be designed for max. 3.3 A and should be integrated into
the 30 V/DC voltage section.
Ì For use and applications as per the requirements of , a connection cable
listed under the UL category code CYJV2 or CYJV must be used and the following requirements met: The connection cables of EUCHNER meet these
requirements. The same requirement applies to the safety outputs.
Ì All electrical outputs must have an adequate protective circuit for inductive
loads. The outputs must be protected with a free-wheeling diode for this purpose. RC interference suppression units must not be used.
Ì Power devices which are a powerful source of interference must be installed
in a separate location away from the input and output circuits for signal processing. The cable routing for safety circuits should be as far away as possible from the cables of the power circuits.
Ì In order to avoid EMC interference, the physical environmental and operating
conditions at the installation site of the device must comply with the requirements according to the standard EN 60204-1:2006, section 4.4.2 (EMC).
Ì Please pay attention to any interference fields in case of devices such as fre-
quency converters or induction heating systems. Observe the EMC instructions in the manuals from the respective manufacturer.
If the device does not appear to function when operating voltage is applied (e.g.
green STATE LED does not flash), the safety switch must be returned unopened
to the manufacturer.
Notes for operation with safe control systems
Important:
Devices with start button and feedback loop are not suitable for connection to
safe control systems.
Please observe the following requirements for connection to safe control systems:
Ì Use a common power supply for the control system and the connected safety
switches.
Ì A clocked power supply must not be used for UB. Tap the supply voltage
directly from the power supply unit. If the supply voltage is connected to a
terminal of a safe control system, this output must provide sufficient electrical
current.
Important:
Ì Outputs OA and OB can be connected to the safe inputs of a control system.
Prerequisite: The input must be suitable for clocked safety signals (OSSD signals, e.g. from light curtains). The control system must tolerate clock pulses
on the input signals. This normally can be set up by parameter assignment in
the control system. Observe the notes of the control system manufacturer.
For the pulse duration of your safety switch, please refer to the section Typical system times on page 18.
A detailed example of connecting and setting the parameters of the control system
is available for many devices at www.euchner.de in the download area » Applications
» CES. The features of the respective device are dealt with there in greater detail.
Devices for direct connection to IP65 field modules
The version CES-AP-...-SB-... (M12, 5-pin; pin 5 not assigned) is optimized for connection to decentralized peripheral systems, such as the ET200pro series from
Siemens. The devices are assigned parameters and connected like an OSSD (e.g.
like light curtains).
The 5-pin M12 plug connector can be connected directly to the socket of an IP65
field module (e.g. ET200pro) with aid of the connection cables on page 22. If flying leads are used, connection to IP20 input and output modules (e.g. ET200s) is
naturally also possible.
Observe the following notes prior to connection:
Ì Parameter assignment might be required for the input/output modules (see
application example at www.euchner.de in the area Download ›› Applications
›› CES).
Ì Additionally observe notes from the control system manufacturer where nec-
Ì The contacts OA/OB are short circuit proof.Ì A short circuit between OA and OB is detected by the switch. Ì A short circuit in the cable can be excluded by laying the cable with protection.
Fuse protection for power supply
The power supply must be provided with fuse protection depending on the current
required for the outputs. The following rules apply:
Max. current consumption of a switch I
I
= IUB + I
max
= Switch operating current (30 mA)
I
UB
= Monitoring output load current (max. 50 mA)
I
OUT
= Load current safety outputs OA + OB (2 x max. 150 mA)
I
OA+OB
OUT
+ I
OA+OB
max
Requirements for connection cables
Risk of damage to equipment or malfunctions as a result of incorrect connec-
tion cables.
Ì Use connection components and connection cables from EUCHNERÌ On the usage of other connection components, the requirements in the fol-
lowing table apply. EUCHNER provides no warranty for safe function in case
of failure to comply with these requirements.
Ì The connection cable must not be longer than 180 m in total.
Observe the following requirements with respect to the connection cables:
ParameterValueUnit
Wire cross-section min.0.14mm²
R max.150W/km
C max.120nF/km
L max.0.65mH/km
Recommended cable typeLIYY 8x or 5x0.14 mm²
Connect the device as shown in Figure 3. The OUT output can be connected to a
control system as a monitoring output.
Important:
The subsystem CES-AP complies with PL e in accordance with EN 13849-1. To
integrate the subsystem in a category 3 or 4 structure, it is necessary to monitor
the downstream load (the feedback loop must be monitored).
These examples show only an excerpt that is relevant for connection of the CES
system. The example illustrated here does not show complete system planning.
The user is responsible for safe integration in the overall system.
DC 24 V
-F1
-V1
-K1
UB1
0V3
OA2
OB4
NC6
OUT5
-V2
-K2
M8 plug-connector
(6-pin)
CES-AP-C.2-...
GND
Fig. 3: Connection example CES-AP-CR2-CH/CES-AP-CL2-CH
¨ The green LED flashes quickly. A self-test is performed during this time. Af-
ter this, the LED flashes cyclically one time and signals that it is in standby
state.
Normal operation: Door closed
- Door open
- Actuator in boundary area
(refer to the status table for further signal functions)
- Internal electronics fault
- Fault at the inputs/outputs
Warning!
2. Move actuator to the read head (observe distance < S
).
ao
¨ The green LED illu minates continuously and indic ates the detection of the
actuator.
If the green LED is flashing at approx. 2 Hz, the actuator is in the boundary area.
In this case the safety guard must be re-adjusted such that the actuator is completely in the read area.
Functional check
After installation and any fault, the safety function must be fully checked. Proceed
as follows:
Danger of fatal injury as a result of faults in installation and functional check.
Ì Before carrying out the functional check, make sure that there are no per-
sons in the danger area.
Ì Observe the valid accident prevention regulations.
1. Switch on operating voltage.
Ì The STATE LED then flashes at regular intervals.
2. Close all safety guards.
Ì The machine must not start automatically.Ì The green STATE LED illuminates continuously.
3. Enable operation in the control system.
4. Open the safety guard.
Ì The machine must switch off and it must not be possible to start it as long as
the safety guard is open.
Ì The green LED STATE flashes at regular intervals.
3 xDefective actuator (e.g. fault in code or code not readable)
4 x
5 xInternal fault (e.g. component faulty, data error)
10 Hz (8 s)
3 x
XAny state
State
DIA (red)
Normal operation, door closed
Normal operation, door closed, actuator in the boundary area ¨ Re-adjust door
Output error
(e.g. short circuits, loss of switching ability)
LED not illuminated
LED illuminated
LED flashes for 8 seconds at 10 Hz
LED flashes three times, and this is then repeated
Important:
After the cause has been remedied, faults can generally be reset by opening
and closing the door. If the fault is still displayed afterward, briefly interrupt the
power supply. Please contact the manufacturer if the fault could not be reset after
restarting.
If you do not find the displayed device status in the System status table, this indi-
cates an internal device fault. In this case, you should contact the manufacturer.
If a product data sheet is included with the product, the information on the data
sheet applies in case of discrepancies with the operating instructions.
Technical data for safety switch CES-AP-CR2-CH/
CES-AP-CL2-CH
ParameterValueUnit
min.typ.max.
Housing materialPlastic PBT
Dimensions95 x 30 x 12mm
Weight0.04kg
Ambient temperature at U
Ready delay: After switching on, the unit carries out a self-test. The system is
ready for operation only after this time.
Switch-on time of safety outputs: The max. reaction time from the moment
when the actuator is at the operating distance (safety door closed) to the moment
when the safety outputs switch on T
Risk time according to EN 60947-5-3: If an actuator moves outside the operating distance, the safety outputs OA and OB are deactivated after a maximum
of 260 ms.
Difference time: The safety outputs OA and OB switch with a slight time offset.
They have the same signal state at the latest after a difference time of 10 ms.
Clock pulses at the safety outputs: The device generates its own clock signal
on the output lines OA/OB. A downstream control system must tolerate these test
pulses, which may have a length of up to 400 µs.
This can usually be set up in the control systems by parameter assignment. If
parameter assignment is not possible for your control system or if shorter clock
pulses are required, please contact our support organization.
Loss of the safety function because of damage to the system.
In case of damage, the related component must be replaced completely.
Only accessories or spare parts that can be ordered from EUCHNER may be
replaced.
Regular inspection of the following is necessary to ensure trouble-free long-term
operation:
Ì Check the switching function (see section Functional check)Ì Check the secure fastening of the devices and the connectionsÌ Check for soiling
No servicing is required, repairs to the device are only allowed to be made by the
manufacturer.
Note:
Service
The year of manufacture can be seen in the lower right corner of the rating plate.
The current version number in the format (V X.X.X) can also be found on the device.
The safety door must be re-adjusted when the device indicates that the actuator
is in the boundary area.