Particularities for operation on decentralized peripheral systems 11
Safety in case of faults 11
Fuse protection for power supply 11
Requirements for connection cables 12
Connector assignment and wire color for safety switch CES-I-AP-M-C04 13
Connecting a CES-I-AP-...-SI-... (pin 5 not assigned) to a decentralized peripheral system
(e.g. ET200pro series from Siemens) 15
Setup 16
LED indicators 16
Initial setup 16
Functional check 17
System status table 18
Technical data 19
Technical data for safety switch CES-I-AP-M-C04 19
Technical data for actuator CES-A-BBN-C04 21
Technical data for actuator CES-A-BDN-06 23
This document is valid for all safety switches CES-I-AP-M-C04.
Correct use
The Coded Electronic Safety switches series CES are safety devices for monitoring movable safety guards.
In combination with a separating safety guard and the machine control, this safety
component prevents dangerous machine movements from occurring while the
safety guard is open. A stop command is triggered if the safety guard is opened
during the dangerous machine function.
Before safety switches are used, a risk assessment must be performed on the
machine, e.g. in accordance with:
Ì EN ISO 13849-1, Safety of machinery. Safety related parts of control systems.
General principles for design
Ì EN ISO 12100, Safety of machinery - General principles for design - Risk as-
sessment and risk reduction
Important!
Ì IEC 62061, Safety of machinery - Functional safety of safety-related electrical,
electronic and programmable electronic control systems
Correct use includes compliance with the relevant requirements for installation
and operation, for example
Ì EN ISO 13849-1, Safety of machinery. Safety related parts of control systems.
General principles for design
Ì EN 1088, Safety of machinery. Interlocking devices associated with guards.
Principles for design and selection
Ì EN 60204-1, Safety of machinery. Electrical equipment of machines. General
requirements
Ì EN 60947-5-3, Specification for low-voltage switchgear and controlgear. Con-
trol circuit devices and switching elements. Requirements for proximity devices
with defined behavior under fault conditions
The safety switch must be used only in conjunction with the designated CES actuators from EUCHNER. On the use of different actuators, EUCHNER provides no
warranty for safe function.
Ì The user is responsible for the integration of the device into a safe overall
system. For this purpose, the overall system must be validated, e.g. in accordance with EN ISO 13849-2.
Ì In the estimation of the PL for the overall system, a maximum value of 100
years can be assumed for the MTTFd according to the limit value in EN ISO
13849-1:2008, section 4.5.2. This corresponds to a minimum value for the
PFHd of 2.47x10-8/h.
Ì Correct use requires observing the permissible operating parameters (see
Technical data).
Ì If a product data sheet is included with the product, the information on the
data sheet applies in case of discrepancies with the operating instructions.
Ì It is only allowed to use components that are permissible in accordance with
In case of failure to comply with the conditions for correct use stated above, or
if the safety instructions are not followed, or if any servicing is not performed as
required, liability will be excluded and the warranty void.
Safety switches fulfill personal protection functions. Incorrect installation or tampering can lead to fatal injuries to personnel.
Check the safe function of the safety guard particularly
Ì after any setup workÌ after the replacement of a CES componentÌ after an extended period without useÌ after every fault
Independent of these checks, the safe function of the safety guard should be
checked at suitable intervals as part of the maintenance schedule.
Warning!
Loss of safety function in the event of incorrect connection or incorrect use.
Ì Safety switches must not be bypassed (bridging of contacts), turned away,
removed or otherwise rendered ineffective.
On this topic pay attention in particular to the measures for reducing the possibility of bypassing from EN 1088:1995+A2:2008, section 5.7.
Important!
The device is only allowed to be installed and placed in operation by authorized
personnel
Ì who are familiar with the correct handling of safety components Ì who are familiar with the applicable EMC regulationsÌ who are familiar with the applicable regulations on health and safety and ac-
cident prevention
Ì who have read and understood the operating instructions
Prior to use, read the operating instructions and keep these in a safe place. Ensure
that the operating instructions are always available during mounting, setup and
servicing. EUCHNER cannot provide any warranty in relation to the readability
of the CD for the storage period required. For this reason you should archive
a printed copy of the operating instructions. You can download the operating
instructions from www.EUCHNER.de.
The device complies with the following safety requirements:
Ì Safety category 4, PLe according to EN ISO 13849-1Ì Redundant design of the circuit in the unit with self-monitoringÌ This means that the safety system still functions even if an internal component
fails
Ì The switch state of the semiconductor outputs is continuously monitored inter-
nally
Ì Short circuit detection at the safety outputs by pulsed signals
The following switch-on condition applies for the safety outputs FO1A and FO1B
(see also System status table and section Typical system times):
Ì Safety guard closed
The CES system consists of the following components: coded actuator (transponder) and switch.
Every EUCHNER actuator supplied has an electronic coding (unique coding) that is
read by the read head. Only if a correct coding is detected does the system accept
the actuator. The code in an actuator cannot be reprogrammed.
Unlike systems with unique code detection, on the CES-I-AP-M-C04 a specific code
is not polled but instead it is only checked whether the actuator is of a type that can
be detected by the system (multicode detection). There is no exact comparison of
the actuator code with the code defined in the safety switch (unique code detection).
The safety switch is fastened to the fixed part of the safety guard.
The actuator attached to the movable part of the safety guard is moved towards
the read head fitted in the safety switch by closing the door. When the switch-on
distance is reached, power is supplied to the actuator by the read head by induction and data can be transferred.
If a permissible code is detected, the safety outputs are released. Independent of
the safety outputs, monitoring output OD switches on as soon as the actuator is
in the operating distance.
Due to the combination of dynamic polling of the actuator and the redundant,
diverse design of the safety electronics with the two feedback safety outputs, the
safety switch will enter the safe state with every detectable fault.
When the safety guard is opened, the safety outputs switch off the safety circuit
and the monitoring output OD is switched off. The state of the safety outputs is
monitored internally by two microprocessors.
If faults are detected, the safety circuit is switched off and the DIA LED illuminates.
In case of devices with a monitoring output OI, the output is switched on.
The safety switch has a redundant circuit design with self-monitoring. This means
that the safety system is still effective even if a component fails.
The system is designed so that failures will not result in the loss of the safety function. The occurrence of failures is detected by cyclic self-monitoring at the latest
on the next demand to switch the safety outputs (e.g. on starting).
If the safety door with the actuator should settle over time, the actuator can drift
out of the switch operating distance. The device recognizes this situation and
indicates that the actuator is in the limit range. This allows the safety door to be
readjusted in time.
Risk of damage to equipment as a result of incorrect installation. Safety switches
must not be used as a mechanical end stop.
Ì Fit an additional end stop for the movable part of the safety guard.
Important!
Ì From the assured switch-off distance S
down.
, the safety outputs are safely shut
ar
Ì When mounting several safety switches and actuators, observe the stipu-
lated minimum distance to avoid mutual interference.
Installation options
min. 140 mm
Ì The operating distance changes during the mounting of the actuator as a
function of the material used for the safety guard. Observe direction of arrow
on the device (see figure below).
Permissible approach directions
AB
CD
Note the following points:
Ì Actuator and safety switch must be easily accessible for inspection and re-
placement.
Ì The switching operation must only be triggered by the specific actuator desig-
nated for this purpose. For permissible combinations please see the table of
possible combinations on page 4.
Ì Actuator and safety switch must be fitted so that
Ì the front faces are at the minimum switch-on distance 0.8 x S
when the safety guard is closed (see section Operating distances). A minimum distance dependent on the actuator and the approach direction must be
maintained for a side approach direction:
- for CES-A-BBN-C04-115271 6 mm (A + B) / 2 mm (C + D)
- for CES-A-BDN-06-104730 10 mm
Ì when the safety guard is open up to the distance S
tance), a hazard is excluded.
(assured switch-off dis-
ar
or closer
ao
Ì the actuator is positively mounted on the safety guard, e.g. by using the
safety screws included.
Ì Pay attention to the maximum tightening torque of 0.8 Nm for the safety
In case of an error, loss of the safety function through incorrect connection.
Ì To ensure safety, both safety outputs (FO1A and FO1B) must always be
evaluated.
Ì The monitoring output OD must not be used as a safety output.Ì Lay the connection cables with protection to prevent the risk of short cir-
cuits.
Caution!
Risk of damage to equipment or malfunctions as a result of incorrect connection.
Ì The device generates its own clock signal on the output lines FO1A/FO1B. A
downstream control system must tolerate these test pulses, which may last
up to 0.3 ms.
No test pulses are output when the safety outputs are switched off.
Ì The inputs on an evaluation unit connected must be positive-switching, as the
two outputs on the safety switch deliver a level of +24 V in the switched-on
state.
Ì All the electrical connections must either be isolated from the mains supply
by a safety transformer according to IEC 61558-2-6 with limited output voltage in the event of a fault, or by other equivalent isolation measures (PELV).
Ì The device tolerates voltage interruptions in the operating voltage U
to 5 ms. Voltage interruptions on UB are also output on the safety outputs
and monitoring outputs.
Ì For use and operation as per the requirements, a power supply with the
feature "for use in class 2 circuits" must be used. The same requirement applies to the safety outputs.
Alternative solutions must comply with the following requirements:
a) Electrically isolated power supply unit with a max. open-circuit voltage of 30
V/DC and a limited current of max. 8 A.
b) Electrically isolated power supply unit in combination with fuse as per UL248.
This fuse should be designed for max. 3.3 A and should be integrated into
the 30 V/DC voltage section.
Ì For use and operation as per the requirements*, a connection cable
listed under the UL category code CYJV2 must be used. The connection
cables from EUCHNER meet these requirements. The same requirement applies to the safety outputs.
Ì All electrical outputs must have an adequate protective circuit for inductive
loads. The outputs must be protected with a free-wheeling diode for this purpose. RC interference suppression units must not be used.
Ì Power devices which are a powerful source of interference must be installed
in a separate location away from the input and output circuits for signal processing. The cable routing for safety circuits should be as far away as possible from the cables of the power circuits.
Ì In order to avoid EMC interference, the physical environmental and operating
conditions at the installation site of the device must comply with the requirements according to the standard EN 60204-1:2006, section 4.4.2 (EMC).
* Note on the scope of the UL approval: Only for applications as per NFPA 79 (Industrial Machinery)
The devices have been tested as per the requirements of UL508 (protection against electric shock and fire).
If the device does not appear to function when operating voltage is applied (e.g.
green STATE LED does not flash), the safety switch must be returned unopened
to the manufacturer.
Particularities for operation on decentralized peripheral systems
The version CES-I-AP-...-SI-... (M12, 5-pin; pin 5 not assigned) is optimized for connection to decentralized peripheral systems with M12 plug connector, such as the
ET200pro series from Siemens. The devices are parameterized and connected
like an OSSD (e.g. like light curtains).
The 5-pin M12 plug connector can be connected directly to the socket of an IP65
field module (e.g. ET200pro). If flying leads are used, connection to IP20 input
and output modules (e.g. ET200s) is naturally also possible.
Important!
Observe the following notes prior to connection:
Ì Parameter assignment must be performed for the input/output modules (see
application example at www.EUCHNER.de, in the area Download ›› Applications ›› CES).
Ì Additionally observe notes from the control system manufacturer where nec-
essary.
Safety in case of faults
Ì The operating voltage UÌ The contacts FO1A/FO1B are short circuit-proof.Ì A short circuit between FO1A and FO1B is detected by the switch. Ì A short circuit in the cable can be excluded by laying the cable with protection.
is reverse polarity protected.
B
Fuse protection for power supply
The power supply must be provided with fuse protection depending on the current
required for the outputs. The following rules apply:
Max. current consumption of a switch I
I
= IUB + IOD + I
max
= Switch operating current (35 mA)
I
UB
= Monitoring output load current (max. 50 mA)
I
OD
I
FO1A+FO1B
= Load current of safety outputs FO1A + FO1B (2 x max. 150 mA)
Connect the device as shown in Figure 3. The OD output can also be connected
to a control system as a monitoring output.
Important!
The subsystem CES-I-AP complies with PL e in accordance with EN 13849-1. To
integrate the subsystem in a category 3 or 4 structure, it is necessary to monitor
the downstream load (the feedback loop must be monitored).
These examples show only an excerpt that is relevant for connection of the CES
system. The example illustrated here does not show complete system planning.
The user is responsible for safe integration in the overall system.
A self-test is performed during this time. After this, the green LED flashes
cyclically one time and signals that it is in standby state.
Normal operation: Door closed
- Power Up
- Door open
- Actuator in the limit range
(refer to the status table for further signal functions)
- Internal electronics fault
- Fault at the inputs/outputs
2. Move actuator to the read head (observe distance < S
).
ao
¨ The green LED illuminates continuously and indicates the detection of the
actuator.
If the green LED is flashing quickly, the actuator is in the boundary area. In
this case the safety guard must be re-adjusted such that the actuator is completely in the read area.
3 xDefective actuator (e.g. fault in code or code not readable)
4 xOutput error (e.g. short circuits, loss of switching ability)
3 x
DIA (red)
Normal operation, door closed
Normal operation, door closed, actuator in limit range ¨ Re-adjust door
- Internal fault (e.g. component faulty, data error)
- Fault on the power supply (e.g. shutdown pulse duration for pulsed power supply too
LED not illuminated
LED illuminated
LED flashes for 8 seconds at 10 Hz
LED flashes three times, and this is then repeated
long)
Important!
After the cause has been remedied, faults can generally be reset by opening
and closing the door. If the fault is still displayed afterward, briefly interrupt the
power supply. Please contact the manufacturer if the fault could not be reset after
restarting.
If you do not find the displayed device status in the System status table, this indicates an internal device fault. In this case, you should contact the manufacturer.
If a product data sheet is included with the product, the information on the data
sheet applies in case of discrepancies with the operating instructions.
Technical data for safety switch CES-I-AP-M-C04
ParameterValueUnit
min.typ.max.
Housing materialPlastic PBT
Dimensions42 x 25 x 18mm
Mass (without connection cable)0.05kg
Ambient temperature-25-+ 65°C
Connection- Plug connector M8, 4-pin or
Degree of protectionIP67
Safety classIII
Degree of contamination 3
Installation positionAny
Installation methodNon-flush
Operating voltage UB (reverse po-
Safety outputs FO1A/FO1BSemiconductor outputs, p-switching, short circuit-proof
- Output voltage
U(FO1A)/U(FO1B)
HIGH
HIGH
LOW
Switching current per safety output1-150mA
Utilization category
according to EN IEC 60947-5-2
Off-state current I
Monitoring output ODSemiconductor output p-switching, short circuit-proof
- Output voltage0.8 x U
- Max. load--50mA
Rated insulation voltage U
Rated impulse withstand voltage U
Resilience to vibration
Switching frequency--1Hz
Repeat accuracy R ≤ 10%
EMC protection requirementsIn accordance with EN IEC 60947-5-3 and EN IEC 61326-3-1
Reliability values acc. to EN ISO 13849-1
Category4
Performance LevelPL e
PFH
Mission time20years
1) The device tolerates voltage interruptions of up to 5 ms.
2) Values at a switching current of 50 mA without taking into account the cable length.
1)
2)
U(FO1A)
U(FO1B)
U(FO1A)/U(FO1B)0-1
r
i
d
- Connection cable PUR, 0.25 mm², with plug connector M12,
5-pin, or
- Connection cable PUR with flying lead, 5 x 0.25 mm²
IP69K (only version with plug connector M8 and mating connec-
Caution: outputs must be protected with a free-wheeling diode in
Ready delay: After switching on, the unit carries out a self-test for 0.5 s. The
system is ready for operation only after this time.
Switch-on time of safety outputs: The max. reaction time from the moment
when the actuator is at the operating distance (safety door closed) to the moment
when the safety outputs switch on T
Risk time according to EN 60947-5-3: If an actuator moves outside the
operating distance, the safety outputs FO1A and FO1B are deactivated after a
maximum of 260 ms.
Difference time: The safety outputs FO1A and FO1B switch with a slight delay
in relation to each other. They have the same signal state at the latest after a difference time of 10 ms.
Test pulses at the safety outputs: The device generates its own clock signal on
the output lines FO1A/FO1B. A downstream control system must tolerate these
test pulses, which may last up to 0.3 ms (applies for a load with C < 30 nF and
R < 20 kW).
This can usually be set up in the control systems by parameter assignment. If
parameter assignment is not possible for your control system or if shorter test
pulses are required, please contact our support organization.
CES-A-BBN-C04-115271Actuator 42 x 25 x 18 mm115271
CES-A-BDN-06-104730Actuator 26 mm x ∅ 6 mm104730
Inspection and service
Warning!
Loss of the safety function because of damage to the system.
In case of damage, the related component must be replaced completely.
Only accessories or spare parts that can be ordered from EUCHNER may be
replaced.
Service
Regular inspection of the following is necessary to ensure trouble-free long-term
operation:
Ì Check the switching function (see section Functional check)Ì Check the secure fastening of the devices and the connectionsÌ Check for soiling
No servicing is required. Repairs to the device are only allowed to be made by
the manufacturer.
Note!
The year of manufacture can be seen in the lower right corner of the rating plate.
The current version number in the format (V X.X.X) can also be found on the device.
The safety door must be re-adjusted when the device indicates that the actuator
is in the limit range.