Pilz PNOZmulti system extension

Pilz PNOZmulti Configurable Safety Control System: A Complete Guide to System Expansion Planning, Reaction Time Calculation, and Troubleshooting

In modern mechanical safety control, fixed safety relays often fail to meet the requirements of complex applications such as multiple emergency stop zones, actuators with different safety levels, speed monitoring, analog input, and distributed I/O. Pilz's PNOZmulti series configurable safety controllers provide modular and programmable solutions. However, many engineers often encounter issues such as unclear system scalability, excessive response time, and incorrect module configuration during actual project planning, resulting in security features not reaching the required level or responding too slowly.

This article is based on the PNOZmulti system expansion manual (document 1002217-EN-19), which systematically outlines the maximum expansion configuration, expansion module types, and left and right slot allocation rules for three platforms - PNOZmulti Classic, PNOZmulti Mini, and PNOZmulti 2. More importantly, we will provide a detailed interpretation of the calculation formula for system response time and guide you in accurately calculating the maximum turn off delay by combining multiple practical configuration cases (input from safety I/O, output to semiconductor or relay contacts, and connecting multiple controllers through Link or SafetyNET p). Finally, practical suggestions are provided for common configuration errors, reasons for exceeding delay limits, and on-site troubleshooting.

Comparison of System Scalability among the Three Major Platforms of PNOZmulti

2.1 PNOZmulti Classic (base PNOZ m0p/m1p/m2p/m3p)

Base type: PNOZ m0p (ETH), m1p (ETH), m2p (ETH), m3p (ETH)

Maximum Expansion:

On the right side of the base: up to 8 expansion modules (input/output/speed monitoring/analog).

On the left side of the base: up to 4 expansion modules (analog input module PNOZ ma1p)+1 fieldbus module.

Link module: Each PNOZ ml1p can connect to 2 bases (for dual controller redundancy or expansion); Each PNOZ ml2p can connect up to 4 distributed modules PDP67 (IP67 safety I/O) and support up to 16 distributed modules (4 link modules x 4).

Common extension modules (right slot):

PNOZ mi1p: 8-way secure input

PNOZ mi2p: 8-channel standard input (non secure)

PNOZ mo1p: 4-channel secure semiconductor output

PNOZ mo2p: 2-channel safety relay output

PNOZ mo3p: 2-channel bipolar safe semiconductor output

PNOZ mo4p: 4-channel safety relay output

PNOZ mo5p: 4-channel diverse redundant relay outputs

PNOZ ms1p~ms4p: Speed monitoring module (1 or 2 axes, supporting proximity switches, incremental encoders Sin/Cos/TTL/HTL)

Note: Different base models support different numbers of modules on the right side. For example, PNOZ m0p does not support right side extensions (0), while m1p/m2p/m3p supports 8. The number of modules on the left side is 4.

2.2 PNOZmulti Mini (base PNOZ mm0p/mm0.1p/mm0.2p)

Maximum Expansion:

On the right side of the base: only one PNOZ sigma expansion module (such as PNOZ s7 relay output)+optional one contact expansion module (such as PNOZ s7.1, which can be connected to an external PNOZ s7/s10/s11 for contact expansion).

On the left side of the base: up to 1 fieldbus module+1 communication module+4 link modules (PNOZ mml2p is used to connect distributed PDP67) → up to 16 distributed modules.

Link module: PNOZ mml1p can connect 2 Mini bases; PNOZ mml2p connects distributed modules.

Common extensions (right slot):

PNOZ s7, s7.1, s7.2, s10, s11: Single channel safety relay output

PNOZ s22: Dual safety relay output

Note: PNOZ mm0p does not support any extensions; Mm0.1p and mm0.2p support the aforementioned Sigma module.

2.3 PNOZmulti 2 (base PNOZ m B0/m B0.1/m B1/m C0)

Maximum Expansion:

On the right side of the base:

PNOZ m B0: up to 6 security extension modules (including input/output/speed monitoring/analog)

PNOZ m B1: up to 12 security extension modules (but the total number of PNOZ m EF 4DI4DOR, 4DI4DORD, and 2MM does not exceed 8); And it supports up to 6 standard (non safety) output modules (such as PNOZ m ES 14DO), which must be placed at the right end of the safety module.

PNOZ m B0.1: Only 1 expansion module

PNOZ m C0: No extension

On the left side of the base: up to 4 expansion modules+1 fieldbus module+1 communication module (applicable to m B0/B1).

Link module: PNOZ m EF Multi Link (connecting two bases); PNOZ m EF PDP Link (connects up to 4 PDP67 distributed modules, up to 16); PNOZ m EF SafetyNET (up to 16 SafetyNET p RTFL stations connected linearly).

Common extensions (right slot):

PNOZ m EF 16DI: 16 secure inputs

PNOZ m EF 8DI4DO: 8-in 4-out semiconductor safety output

PNOZ m EF 4DI4DOR: 4-in 4-out relay safety output

PNOZ m EF 2DOR: 2-channel safety relay output

PNOZ m EF 1MM/2MM: motion monitoring (1 or 2 axes)

PNOZ m ES 14DO: 14 standard semiconductor outputs (only m B1 supports 6)

Calculation of System Reaction Time: Principles and Formulas

The total response time of the safety control system (from input signal change to output cut-off) directly determines the safety distance and risk assessment. The reaction time of PNOZmulti system consists of three parts:

t ReactionMax=t Max input delay+t Max processing time+t Max switch-off delay at output 

t ReactionMax=t Max input delay+t Max processing time+t Max switch-off delay at output

Maximum input delay: The detection delay of signal changes by the input module, including hardware filtering, signal smoothing, pulse suppression, etc.

Maximum processing time: the time for the base CPU to execute the user program (if the I/O is in the same module, or the module program is involved in exchanging data with the main program, it will be increased additionally).

Maximum turn off delay: the action time of internal relays or semiconductor turn off time of the output module.

The "maximum shutdown delay" for each module provided in the manual already includes the processing time of the base, so there is no need to repeatedly add processing time when using the standard formula. But when it comes to module programs (such as speed monitoring module internal processing) or when the main program repeatedly transmits signals through program connectors, the corresponding time needs to be accumulated.

3.1 Default Input Delay and Shutdown Delay Quick Check on Each Platform

PNOZmulti Classic：

Maximum input delay and maximum shutdown delay of the module (output including processing time)

PNOZ m0p~m3p (base itself) 4 ms 30 ms (semiconductor)/50 ms (relay)

PNOZ mi1p / mi2p 4 ms -

PNOZ mo1p / mo3p - 30 ms

PNOZ mo2p / mo4p / mo5p - 50 ms

PNOZ ml1p (link module) 0 ms (from partner) 35 ms (transmission delay)

PNOZ ml2p+PDP67 15 ms+input module delay 35 ms

PNOZ ma1p (analog) 100 ms-

PNOZ ms1p~ms4p (speed) 10 ms+1/f depending on configuration

PNOZmulti Mini：

Maximum input delay and maximum shutdown delay of the module

PNOZ mm0p~mm0.2p 4 ms 30 ms (semiconductor)/35 ms (virtual output)

PNOZ s7 and other Sigma modules -30 ms+module delay (30 ms) → total 60 ms

PNOZmulti 2：

Maximum input delay, maximum processing time, and maximum shutdown delay of the module

PNOZ m B0 / B0.1 2 ms 30 ms 1 ms

PNOZ m B1 (FS Security Section) -30 ms-

PNOZ m EF 16DI 8 ms - -

PNOZ m EF 8DI4DO 8 ms - 3 ms

PNOZ m EF 4DI4DOR 8 ms - 22 ms

PNOZ m EF 2DOR 8 ms - 22 ms

PNOZ m EF 1MM (main program configuration) 1/f+16 ms --

PNOZ m EF Multi Link 0 ms -5 ms (transmission)

PNOZ m ES 14DO (standard output) -1 ms

3.2 Key influencing factors

Signal smoothing: It can be set on the analog module PNOZ m EF 4AI (default 2 ms), which will add additional input delay.

Pulse suppression: It can be set on modules such as PNOZ m EF 8DI2DOT (default 0.8 ms) to filter out sensor self-test pulses, but it will increase input delay.

Test pulse suppression: Some safety switches (such as outputs with self-test pulses) require activation of "test pulse suppression", which increases the response time by up to 15 ms.

Program connector: When a signal is transmitted multiple times between the module program and the main program, the corresponding processing time (e.g. 8 ms) must be accumulated for each pass.

Frequency measurement (motion monitoring): The input delay is related to the current actual frequency: delay=1/f_actual+fixed value (such as 16 ms).

Practical case study of reaction time calculation

Case 1: PNOZmulti Classic - Input from PNOZ mi2p, output from PNOZ mo3p

Input delay: PNOZ mi2p=4 ms

Output shutdown delay: PNOZ mo3p=30 ms

tmax=four+thirty=thirty-fourms t max=4+30=34 ms

Case 2: PNOZmulti Mini - Input from base mm0.1p, output from PNOZ s7

Base input delay: 4 ms

PNOZ s7 shutdown delay: 30 ms (module itself)+30 ms (Sigma module additional delay)=60 ms

tmax=four+sixty=sixty-four ms t max=4+60=64 ms

Case 3: PNOZmulti 2 – input from PNOZ m EF 8DI4DO, output from the same module

Input delay: 8 ms

Main program processing time: 30 ms (base)

Output shutdown delay: 3 ms

tma x=eight+thirty+three=forty-one ms 

t max=8+30+3=41 ms

Case 4: PNOZmulti 2- Analog Input to Semiconductor Output

Input delay (PNOZ m EF 4AI): 8 ms+signal smoothing 2 ms=10 ms

Module program processing time: 5 ms

Main program processing time: 30 ms

Output shutdown delay (PNOZ m EF 8DI4DO): 3 ms

t max=ten+five+thirty+three=forty-eight ms 

t max=10+5+30+3=48 ms

Case 5: Speed monitoring configuration in the main program (frequency 100 Hz)

Input delay (PNOZ m EF 1MM): 1/f+16 ms=10+16=26 ms

Main program processing: 30 ms

Base output shutdown: 1 ms

t max=twenty-six+thirty+one=fifty-seven ms 

t max=26+30+1=57 ms

Multi Controller Cascade: PNOZ Multi Link and SafetyNET p

When the output of one controller needs to respond based on the input of another controller (such as multiple machine safety interlocks), the transmission delay across controllers must be considered.

5.1 PNOZmulti Link Connection

Each Link module will increase the transmission delay by approximately 35 ms (data from one Link module to the other). Reaction time calculation formula:

t ReactionMax=Input base input delay+(Transmission delay of sender link)+Intermediate base input delay (0)+Intermediate Link Transmission Delay+Final pedestal output shutdown delay

t ReactionMax=Input base input delay+(sender link transmission delay)+intermediate base input delay (0)+intermediate link transmission delay)+final base output shutdown delay

Actual example (cascading 3 Classic bases):

Base 1 input delay: 4 ms

Base 1 Link transmission: 35 ms

Base 2 Link input delay: 0 ms

Base 2 Link transmission: 35 ms

Base 3 Link input delay: 0 ms

Base 3 output shutdown delay: 30 ms

t to ta l=four+thirty-five+0+thirty-five+0+

thirty=one hundred and four ms 

t total=4+35+0+35+0+30=104 ms

Attention: The more links there are, the more delays accumulate. When an extremely short reaction time is required, the number of cascade stages should be minimized as much as possible.

5.2 SafetyNET p RTFL Connection

The PNOZ m EF SafetyNET module can establish linear secure communication between up to 16 PNOZ multi 2 bases. The transmission delay of each module is 25 ms (the example in the manual shows a total response time of 96 ms from the 8DI4DO output of base 1 to the 8DI4DO input of base 3).

Calculation formula:

t to tal=tin_delay_B one+tproc_B one+t Safe ty NE T_tx+tin_delay_intermediate+t proc_Bx+tout_delay_lastt total=t in_delay_B1+t proc_B1+t SafetyNET_tx+t 

in_delay_intermediate+t proc_Bx+t out_delay_last

When planning, it is essential to calculate the worst-case scenario and confirm the safe distance.

Common configuration errors and troubleshooting

Fault 1: The base cannot recognize the right expansion module, and the LED displays an error code

Possible reasons:

Expansion modules exceed the number supported by the base (e.g. installing 8 modules on PNOZ m B0, error; The actual maximum is 6.

Module position error (some modules such as PNOZ m EF 2MM and 4DI4DOR have a total limit and must be placed in a specific order).

Insufficient power capacity (each module consumes backplane bus current, exceeding the rated value).

troubleshoot

Check the "System Expansion Depends on Base" table and confirm that the number of modules is compliant.

Check if the module is securely inserted into the guide rail and if the bus connector is fully inserted.

Use PNOZmulti Configurator software for hardware configuration, and compatibility and order will be automatically checked during compilation.

Fault 2: Response time exceeds safety function requirements (e.g. insufficient protection distance due to response time of safety grating)

Possible reasons:

Incorrect use of slow relay output (50 ms) instead of semiconductor output (30 ms or lower).

Added unnecessary long delays or used too many program connectors in the main program.

Not activating input filtering optimization (such as setting pulse suppression too high).

When multiple controllers are cascaded, the accumulation of transmission delay is ignored.

Optimization measures:

For time sensitive applications, PNOZ mo1p/mo3p (30 ms) is preferred over mo2p (50 ms).

Reduce timer delay in user programs or move non emergency functions to the standard output module (PNOZ m ES 14DO).

In speed monitoring, selecting the "module program" configuration method can reduce the processing overhead of the main program (but it will increase additional program connector latency, which needs to be balanced).

For Link connections, considering using SafetyNET p (unidirectional 25 ms) may be better than cascading multiple Link connections (35 ms/hop).

Fault 3: The system fails to start or frequently shuts down safely, and the fault indicates an alarm

Possible reasons:

Feedback loop wiring error (the output feedback of expansion modules such as PNOZ mo4p is not connected to the safety input of the base).

Cross short circuit detection triggered (leakage current caused by excessively long dual channel input lines or decreased insulation between lines).

Ground fault (a detection mechanism that triggers a safe shutdown due to a short circuit of an input to ground).

Troubleshooting steps:

Use the online diagnostic function of PNOZmulti Configurator to view specific fault types and channels.

Check the ground resistance of the input line and the insulation resistance between the two channels (should be greater than 1M Ω).

If it is a cross short circuit detection false alarm, the detection function can be temporarily disabled in the configuration for verification, but the final solution should be to improve cable insulation or shorten the length (Rmax=10 Ω limit).

Fault 4: Excessive delay in speed monitoring output, resulting in delayed protection action during overspeed

Reason: Frequency measurement itself requires at least one complete cycle (1/f) to confirm speed. If the speed threshold is set low and the actual frequency changes slowly, the detection time may be as long as several hundred milliseconds.

improve:

Use high-resolution encoders (such as more pulses per revolution) to shorten the measurement cycle.

Enable the 'Quick Response' mode in the configuration (if supported by the module).

Configure the speed monitoring module in the "module program" and directly link the output to the safety output to reduce the impact of the main program scanning cycle (refer to manual case 4.1.11).

Comprehensive Suggestions for System Expansion and Response Time Optimization

Pre calculate maximum response time: During the design phase, use the table provided in the manual to estimate the worst-case delay for each input-output path. Overlay the inherent delays of all external sensors and actuators (such as contactor release time, solenoid valve action time) onto the system response time to ensure compliance with standard requirements.

Reasonably allocate left and right extensions: Left side extensions are usually used for analog, fieldbus, and distributed modules; The right-hand extension is used for most secure I/O and speed monitoring. Do not mix non secure modules into the right side of the secure side (unless explicitly supported).

Avoid excessive cascading: If safety interlocking across multiple controllers is required, prioritize peer-to-peer communication (such as SafetyNET p) over serial Link modules to control the total delay within 100 ms.

Use the latest firmware and configuration software: Pilz periodically updates firmware to optimize response time or add new module support. Please read the release instructions before upgrading.

Regular verification: After being put into operation, use an oscilloscope or safety analyzer to measure the actual time from input signal change to output contact opening, and compare it with the calculated value. The measured value should not exceed 20% of the calculated value.