Mitsubishi Electric MELSEC A Series Manual page 5

[System Design Precautions]
• Safety circuits should be installed external to the programmable controller to ensure that the system as a
whole will continue to operate safely in the event of an external power supply malfunction or a
programmable controller failure.
Erroneous outputs and operation could result in an accident.
1) The following circuitry should be installed outside the programmable controller:
Interlock circuitry for the emergency stop circuit protective circuit, and for reciprocal operations such
as forward/reverse, etc., and interlock circuitry for upper/lower positioning limits, etc., to prevent
machine damage.
2) When the programmable controller detects an abnormal condition, processing is stopped and all
outputs are switched OFF. This happens in the following cases
• When the power supply module's over-current or over-voltage protection device is activated
• When an error (watchdog timer error, etc.) is detected at the PC CPU by the self-diagnosis
function.
Some errors, such as input/output control errors, cannot be detected by the PC CPU, and there may
be cases when all outputs are turned ON when such errors occur. In order to ensure that the
machine operates safely in such cases, a failsafe circuit or mechanism should be provided outside
the programmable controller. Refer to the CPU module user's manual for an example of such a
failsafe circuit.
3) Outputs may become stuck at ON or OFF due to an output module relay or transistor failure. An
external circuit should therefore be provided to monitor output signals whose incorrect operation
could cause serious accidents.
• A circuit should be installed which permits the external power supply to be switched ON only after the
programmable controller power has been switched ON. Accidents caused by erroneous outputs and
motion could result if the external power supply is switched ON first.
• When a data link communication error occurs, the status shown below will be established at the faulty
station. In order to ensure that the system operates safely at such times, an interlock circuit should be
provided in the sequence program (using the communication status information).
Erroneous outputs and operation could result in an accident.
1) The data link data which existed prior to the error will be held.
2) All outputs will be switched OFF at MELSECNET (II, /B, /10) remote I/Ostations.
3) At the MELSECNET/MINI-S3 remote I/O stations, all outputs will be switched OFF or output statuses
will be held, depending on the E.C. mode setting.
For details on procedures for checking faulty stations, and for operation statuses when such errors
occur, refer to the appropriate data link manual.
DANGER