Pilz PNOZmulti Safety Controller Troubleshooting and Maintenance Guide

Pilz PNOZmulti Safety Controller Troubleshooting and Maintenance Guide

PNOZmulti is a modular and configurable safety control system launched by Pilz, divided into PNOZmulti Classic (Classic Series) and PNOZmulti Mini (Compact Series). The system supports up to 20 safety inputs, multiple safety outputs (relays, semiconductors), and rich expansion modules (input/output, speed monitoring, fieldbus, etc.), which can meet safety requirements from simple emergency stops to complex motion monitoring.

However, in on-site applications, safety systems may malfunction due to wiring errors, module mismatches, improper parameter configurations, or external interference. This article is based on the technical characteristics of PNOZmulti system, and summarizes a systematic troubleshooting and maintenance process to help engineers quickly restore production and improve system availability.

System Architecture and Diagnostic Fundamentals

2.1 Hardware composition

The PNOZmulti system consists of basic units and expansion modules. The basic unit (such as PNOZ m0p/m1p/m2p/m3p or PNOZ mm0p/mm0.1p) has a built-in main controller, secure input/output, diagnostic interface, and chip card slot. The expansion module is connected through side jumpers, with a maximum of 4 modules (analog input, Link module) connected to the left side and 8 modules (input, output, speed monitoring, etc.) connected to the right side.

Important limitation: The PNOZmulti Classic base unit can have up to 8 expansion modules on the right side and 4 plus 1 fieldbus module on the left side. The PNOZmulti Mini basic unit (such as mm0.1p) can be connected to the PNOZsigma output module on the right side and one communication/fieldbus module on the left side. Exceeding the limit can cause the configurator to report an error or the system to fail to start.

2.2 Diagnostic Tools and Information

PNOZmulti provides multi-level diagnostic methods:

LED indicator lights: The base unit and each expansion module are equipped with LEDs (PWR, RUN, DIAG, FAULT, I FAULT, O FAULT). RUN is always on during normal operation, and FAULT or specific LED flashes/stays on during faults.

LC Display Screen (Mini Series): Display project name CRC、 Input/output status and error messages. It can be browsed through a rotary encoder.

Error stack: stored in the base unit and can be read online through PNOZmulti Configurator. The stack contains entries for hardware errors, wiring errors, configuration errors, timeouts, chip card and project inconsistencies, and provides help text.

Diagnostic word: Each functional element (such as emergency stop, two hand button) can output a 16 bit diagnostic word, which can be read through fieldbus or interface for visualization or remote diagnosis.

Communication interface: The basic unit provides RS232 or Ethernet interface (ETH version), supports Modbus/TCP, and can be used to read diagnostic data (for non security purposes only).

Diagnostic process suggestion: When the system experiences a safe shutdown, prioritize observing the LED of the basic unit: if FAULT is on, read the error stack through the Configurator; If I FAULT or O FAULT lights up, check if there is a short circuit or disconnection in the corresponding input/output circuit.

Common fault classification and troubleshooting steps

3.1 Power and startup faults

Methods for investigating possible causes of phenomena

The basic unit has no LED lights on. The 24V power supply is not connected or the polarity is reversed. Check the voltage of the A1 (+) and A2 (-) terminals (21.6-28.8V). Ensure SELV/PELV certification for power supply.

The PWR lights up but the RUN does not light up. The project has not been downloaded or the chip card is missing. Insert the correct chip card and perform the download (Mini series requires long pressing the knob for 3-8 seconds).

The system repeatedly restarts and the power of the 24V power supply is insufficient. The Classic base is unloaded for about 8W, and for each additional expansion module, it is about 2.5W. Measure the total load and replace it with a higher power supply if necessary.

Supply interruption before de energy interruption "error: If the power interruption time is less than 20ms, check if the power supply is stable and install UPS or buffer module.

Attention: Classic base units (PNOZ m0p/m1p, etc.) require an independent 24V power supply (X2 terminal) for semiconductor output, which must be connected even if not in use, otherwise the system cannot start.

3.2 Input circuit malfunction

The input signal cannot be recognized by the system or the I FAULT light is on. Common reasons:

Mismatch between wiring method and configuration: In the Configurator, each input can be configured as a single channel or dual channel (with cross monitoring). If dual channel is actually used but configured as single channel, the system will not detect a short circuit, but the safety function may not be triggered. On the contrary, if configured as dual channel but only connected to one wire, an input error will be reported.

Test pulse conflict: The basic unit provides T0~T3 test pulse outputs (24V, 0.5A). These pulses are used to detect short circuits between input contacts. If the test pulse is connected to a sensor that does not meet the requirements (such as a regular photoelectric switch), it may cause false triggering. The test pulse should only be used for dry contacts or sensors that have passed safety assessments.

Insufficient input delay: The maximum delay for standard input is 4ms, and the minimum pulse width is 18ms. If the sensor output pulse width is less than 18ms, the system will not be able to recognize it. Please check the sensor specifications or adjust the input filtering time in the configuration.

Example: A factory's safety door switch uses dual channels, but frequent "channel inconsistency" errors occur. Upon inspection, it was found that the time difference between the actions of two contacts exceeded the configured "Simulataneity" parameter (maximum of 3 seconds). Troubleshooting after increasing the synchronization time or replacing the switch with better action synchronization.

3.3 Output circuit fault

The safety output cannot be connected or the O FAULT light is on:

Semiconductor output overload: The maximum single channel current for PNOZ m0p/m1p semiconductor output (O0~O3) is 2A (48W), and the total current is affected by temperature. If the ambient temperature is greater than 50 ° C, it is necessary to reduce the rating for use (such as reducing the coating plate to 1A/24W). When there is a short circuit, the output will immediately turn off and latch, and must be reset after power failure.

Relay output contact welding: Relay outputs (O4, O5) are used for AC loads or high current DC. Its electrical lifespan sharply decreases with the increase of switch current (see lifespan curve). For example, under AC15 0.2A, the lifespan is 1 million cycles, but if the actual load is 3A, it will decrease to about 100000 cycles. Inductive loads that frequently switch must be equipped with arc extinguishers (such as RC absorbers or varistors).

Feedback loop error: When connecting redundant outputs to external contactors, it is usually necessary to connect the auxiliary contacts of the contactors to the feedback loop (such as I14). If the feedback contact is not closed or configured incorrectly, the system will prevent the output from being connected.

Advanced fault detection: The PNOZmulti Mini base supports single channel semiconductor output "enhanced fault detection", which means that one output can carry two parallel loads while still achieving SIL CL 3. The premise is that the feedback loop has been connected and the external power short circuit has been eliminated.

3.4 Speed monitoring module (PNOZ ms1p/ms2p/ms3p/ms4p) malfunction

The speed monitoring module is used for safety speed, direction, and static monitoring. Common problems:

Encoder signal missing (Enc2 or similar): Check RJ45 connection and shielding. For TTL encoders, a 5V power supply (from the module) is required; For HTL encoders, a 24V power supply is required. If using an adapter (such as PNOZ MSI15p), confirm that the adapter is powered normally.

Improper speed threshold setting: Up to 16 speed thresholds (ms4p) can be set in the Configurator. If the actual speed is higher than the threshold but the module does not output "overspeed", check the "switch disconnection delay" configuration. Reaction time=switch off delay+10ms (f>100Hz) or 10ms+1/f (f<100Hz).

Direction monitoring error: A/B phase signals need to be connected simultaneously. If the direction error output is triggered, check the installation direction of the encoder, which can be reversed in the Configurator.

Cut off pin monitoring: When both incremental encoder and proximity switch are used simultaneously, if the encoder signal is stationary while the proximity switch is still changing, the "cut off pin" fault is triggered. This feature needs to be enabled in the configuration.

3.5 Communication and fieldbus faults

Fieldbus modules (such as PNOZ mc3p PROFIBUS, PNOZ mc8p Ethernet/IP) are unable to communicate:

Station address conflict: The PROFIBUS module uses two rotary switches to set the address (0~99), while DeviceNet uses DIP switches. Ensure that the address is unique and consistent with the main station configuration.

Terminal resistor not connected: Terminal resistors must be connected at both ends of the PROFIBUS and CANopen networks. For PROFIBUS, the module is not integrated internally and needs to be set on the connector.

Virtual input/output not configured: The data exchanged between the fieldbus module and PNOZmulti is mapped through the "Virtual Input/Output" in the Configurator. If i0~i23 is not allocated in the project, the data read and written by the main station will be empty. Attention should be paid to attribute differences when expanding to 128 points.

Diagnostic prompt: There are LEDs on the front of the fieldbus module (such as OFFLINE, ONLINE, FAULT of PROFIBUS). If ONLINE does not light up, check the bus cable and master station status.

System response time calculation and safety features

The total response time of the safety circuit (from input disconnection to output disconnection) must meet the application requirements (such as EN ISO 13849-1). The reaction time of PNOZmulti is calculated by the following formula:

t_ReactionMax = t_InputDelayMax + t_SwitchOffDelayMax

among which

The maximum input delay for the basic unit and input module is 4ms (standard input), and PNOZ mi2p is 15ms.

Output delay: Semiconductor output 30ms, relay output 50ms.

If multiple basic units are connected in series using Link module (PNOZ ml1p), additional data transmission time (35ms per segment) is required. For example, two basic units are cascaded through a Link module, from the input of the first unit to the semiconductor output of the second unit, with a total reaction time of 4ms (input)+35ms (transmission)+30ms (output)=69ms.

Key troubleshooting points: If the response of the security function is significantly slower than the calculated value, check if additional software filtering or logic delay is enabled. In addition, the action time of sensors and actuators themselves should also be included in the total safety time.

Expansion module installation and configuration failure

5.1 Module not recognized or SLx.dF fault

When adding or replacing an expansion module, the system reports "SLx. dF" (Slot x module type changed). This is because the hardware configuration stored in the basic unit does not match the actual detected one. Solution:

Update hardware configuration and add or remove corresponding modules in PNOZmulti Configurator.

Regenerate the project and download it to the chip card or to the base unit via USB/Ethernet.

Ensure that the physical position of the module (in left and right order) is exactly consistent with the position in the configurator. For example, the first extension module on the right should be PNOZ mi1p, etc.

5.2 Connector and Terminator errors

PNOZmulti Classic: A Terminator must be installed on the side where the extension module is not connected. The right interface of the last module on the right needs to be plugged into a PNOZmulti bus terminator; There is no terminator connected to the left side.

PNOZmulti Mini: black/yellow terminator on the left and yellow terminator on the right. Not installing a terminator can cause the system to fail to start or communication to be unstable.

Common error: Forgetting to plug back the terminator after replacing the module on site, resulting in FAULT flashing after the system is powered on. Simply reinsert the terminator and restart.

5.3 Chip card reading failure

Chip card (8kB/32kB) storage project configuration. If the download fails or prompts' CRC error ':

Check if the chip card is physically damaged or inserted incorrectly. The chip card slot has directional markings, and bending insertion can damage the contacts.

Use the Configurator to regenerate the project and save it to the chip card (via a card reader or direct online download).

Insufficient chip card capacity: Large projects (over 8kB) must use a 32kB card. You can view the project size in the Configurator.

Tips for using PNOZmulti Configurator

6.1 Project Download Method

Through Chip Card: Insert the chip card into the PC card reader and use the "Download to Chip Card" function of the Configurator. Then insert the chip card into the base unit, power on, and press and hold the reset button (or knob) for 3-8 seconds until the LED flashes.

Through USB interface: Connect the PC to the base unit using a Mini USB cable (PNOZmulti Mini provides a USB port). Select "Online" mode in the Configurator and download directly.

Through Ethernet: For basic units with ETH suffix (such as PNOZ m1p ETH), download using Modbus/TCP after configuring the IP address.

6.2 Online Diagnosis

After connecting online, you can perform the following operations:

Read error stack: Get detailed error code and text, such as "input I4 short circuit to 24V".

Monitor input/output status: dynamically display the current value of each signal.

View diagnostic words: Custom diagnostic words can indicate states such as overspeed and valve opening.

Forced output (test mode only): Used to verify wiring, but safety functions must be restored before use.

6.3 Project Protection and Backup

Password protection: Set a three-level password (read-only, read-write, hardware configuration modification) in the Configurator. Password loss requires contacting Pilz technical support.

Macro function: Common function blocks (such as emergency stop and safety door) can be saved as macros to reduce errors when reused.

Document output: Automatically generate wiring diagrams, I/O lists, and parameter tables for maintaining archives.

Maintenance and spare parts management suggestions

Regularly check the LED status: Record the LED mode during normal operation for quick identification of abnormalities.

Backup project: After each modification, backup the project file (. pzxx) and chip card contents to the server. Chip cards may age, it is recommended to replace them every two years.

Module corrosion protection: In humid or sulfur-containing environments, use a "coated version" module (such as PNOZ mi1p coated). The standard version module may experience terminal corrosion in harsh environments.

Relay output life monitoring: For applications with frequent switching (such as press machines), record the number of contact actions through the Configurator and replace them in advance when approaching the life limit.

Security verification testing: According to EN ISO 13849-1 requirements, a complete functional test must be conducted every 20 years (TM). It is recommended to conduct an annual fault injection test for all safety circuits on site.

Typical Fault Case Quick Reference Table

Possible causes and solutions for the phenomenon

The RUN light of the basic unit is off, DIAG flashes, and the project is not loaded or the chip card is damaged. Download the project again; Replace chip card

If the input circuit is short circuited, disconnected, or the test pulse configuration is incorrect, check the input terminal voltage; Ensure that the test pulse is only used for passive contacts

O FAULT is always on, output overload or feedback loop is disconnected, measure output current; Check feedback contacts

The speed module has no response, and the encoder power supply is insufficient or the configured frequency exceeds the range of 5V/24V measurement encoder; Check if the input frequency is ≤ 500kHz

PROFIBUS communication interruption station address is duplicated or the terminal resistance is not connected to modify the station address; Set terminal resistors on the bus connector

If the system response time is too long, additional filtering delay or excessive number of stage connections, check the input filtering time in the configuration; Reduce cascading modules

Unable to start project after downloading. Unsupported module combinations were used to check system extension limitations (up to 8 on the right and 4+1 on the left)