User Manual: Safety Module Sm-E
User Manual: Safety Module Sm-E
User Manual: Safety Module Sm-E
MANUEL D'UTILISATION
1/28
THIS DOCUMENT IS AVAILABLE IN
CE DOCUMENT EXISTE AUSSI EN LANGUE LICENSE Rev.
MA Indice A
USER MANUAL
SAFETY MODULE SM-E
SUMMARY ------------------------------------------ 3
6 ENVIRONMENT ------------------------------------------ 14
2 GENERAL DESCRIPTION
The Safety Module is a device dedicated for Diesel engine safety. It has been
designed to meet minimal requirements from all major Marine Classification Societies.
In addition, the Safety Module can also be used in non classified applications.
Thus, every customer can have the benefits of a device that meets marine
requirements, ensuring high quality, reliability, and sturdiness.
Marine rules require that Safety functions, Control functions, and Monitoring functions
must be independent. For safety module, the following requirements are very
important:
All sensors connected as inputs of the SAFETY MODULE MUST NOT be used
for other usage. They must be strictly dedicated for SAFETY MODULE.
Nevertheless it is allowed to duplicate them after signal conditioning.
All outputs dedicated for safety action such as SLOW DOWN or SHUT DOWN
must consist in dry contacts of normally de-energized relays. They MUST NOT
be used for other usage.
A SAFETY MODULE must be supplied with two different power supplies. Each
power supply must be monitored in order to inform the user in case of failure on
one of them.
All failures must be available on outputs to be connected to the monitoring
system in order to inform the user. Several failures can be merged on a same
output if the complete information is available locally. Shutdown action cannot
be merged.
The Safety Module is dedicated for SHUT DOWN function. Slow down functions have
to be done by the monitoring system. It means that the whole system cannot be
approved if the selected monitoring system is not able to handle the slowdown
channels according to marine class rules, if slowdown functions are required.
Remark: If Clarine Rack 65 or Clarine Rack 121 CMR product is used as the monitoring
system, it offers enough output contacts to realise it. These contacts can be latched until
acknowledgement. All boolean conditions, all kinds of inhibitions are possible making it a
very flexible system which does not need any specific development, but only a system
configuration.
3 HARDWARE DESCRIPTION
The Safety Module has been designed to fit on a single PCB. This electronic board is
based on discrete components only and does not include embedded software.
All Safety information are displayed on the front side of the unit. The front side is made
of a polycarbonate sheet stuck on an aluminium plate and is fastened to the PCB using
6 metallic spacers. The front side is drilled with 6 holes (4 mm diameter) to allow
mounting on a cut out of a cabinet with a gasket.
All connections to the Safety Module are available on two rows of terminal blocks
located on the rear side of the electronic board.
All connections to the Safety Module are made with terminal blocks (plugs and
sockets)
The maximum wire cross section that can be used is 1.5 mm²
Connections to the Safety Module have to be done according to the wiring diagram as
shown in appendix 4.
Wiring precautions
Speed sensor signal must be connected using a shielded twisted pair. This cable
must not be neither near nor collinear with power cables.
The Safety Module must be supplied with two different power supplies in order to meet
requirements from marine classification societies.
The characteristics of these power supplies (chargers, batteries, circuit breakers, fuses
etc…) do not belong to the Safety Module supplier. For more details, please refer to
drawings and specifications of the electrical installation intended to use the Safety
Module electronic unit.
There is no galvanic insulation between power supply #1 and power supply #2. 0 Volt
(Minus) are common. 24 Volts (Plus) are wired-OR using diodes on the electronic
board.
If only one power supply is available, (accepted only for non classified applications), it
is necessary to connect this power supply in parallel on both power supply inputs of the
electronic board in order to avoid a power supply fault alarm. In such configuration, if
the power supply is switched off there is no more energy to supply the electronic unit.
All displayed information are turned off and the power supply fault output contact is in
alarm state.
• Protection:
External 0.5 A rated fuse
Protected against reverse polarity
Marine approved for EMI perturbations
IMPORTANT REMARKS :
5.1 Abbreviations
All outputs for safety actions and monitoring are made of dry contacts (relays).
For each fault report output, two pins are available and the nature of the dry contact
(NO or NC) is user configurable by jumpers.
To avoid any mistake or configuration issue, all connections for the SHUTDOWN
output are available on terminal blocks. The relay dedicated to the SHUTDOWN output
is a DPDT type.
For that reason, inputs listed below MUST BE NORMALLY OPEN CONTACTS:
Engine Oil Pressure
Gear Oil pressure
Engine Coolant Temperature
Spare Input #1
Spare Input #2
Line monitoring is done by connecting a 10 kΩ resistor in parallel with each sensor
switch as near as possible to the connections of the switch.
The Input is a contact free of potential, normally open. The Safety Module supplies
this input in order to perform the line monitoring. If a broken line is detected a
dedicated red LED is turned on and a common output called “Sensor fault” is
activated.
A configurable time delay in the range of seconds is available. Five different values
can be selected by a jumper:
no time delay (0.03 s)
2 seconds
4 seconds
8 seconds
16 seconds
The input contact state is permanently monitored. When the contact closes, this
closed state is latched after the selected time delay. It means that even if the
condition disappears and the contact turns back open, the output status remains
active. The output status can be reset only by pressing the reset push buttons AND if
the input condition has disappeared.
The output of the latch is used to:
• Turn on the dedicated red LED
• Activate the “Low Engine Oil Pressure” output (dry contact)
• Provide a true condition for the SHUTDOWN functionality
The Input is a contact free of potential, normally open. The Safety Module supplies
this input in order to perform the line monitoring. If a broken line is detected a
dedicated red LED is turned on and a common output called “Sensor fault” is
activated.
A configurable time delay in the range of seconds is available. Five different values
can be selected by a jumper: no time delay (0.03 s), 2 seconds,
4 seconds, 8 seconds and 16 seconds.
The input contact state is permanently monitored. When the contact closes, this
closed state is latched after the selected time delay. It means that even if the
condition disappears and the contact turns back open, the output status remains
active. The output status can be reset only by pressing the reset push buttons AND if
the input condition has disappeared.
The output of the latch is used to:
• Turn on the dedicated red LED
• Activate the “Low Gear Oil Pressure” output (dry contact)
• Provide a true condition for the SHUTDOWN functionality
The Input is a contact free of potential, normally open. The Safety Module supplies
this input in order to perform the line monitoring. If a broken line is detected a
dedicated red LED is turned on and a common output called “Sensor fault” is
activated.
A configurable time delay in the range of seconds is available. Five different values
can be selected by a jumper: no time delay (0.03 s), 2 seconds,
4 seconds, 8 seconds and 16 seconds.
The input contact state is permanently monitored. When the contact closes, this
closed state is latched after the selected time delay. It means that even if the
condition disappears and the contact turns back open, the output status remains
active. The output status can be reset only by pressing the reset push buttons AND if
the input condition has disappeared.
The output of the latch is used to:
• Turn on the dedicated red LED
• Activate the “High Engine Coolant Temperature” output (dry contact)
• Provide a true condition for the SHUTDOWN functionality
5.5.5 Over-speed
The input has been especially designed to handle a passive magnetic sensor in the
frequency bandwidth 750 – 7500 Hz. bandwidth.
The input signal is conditioned by counting operation and then by a digital to analog
conversion. Counting depends on the engine speed (rpm) and quantity of teeth Nt on
the engine flywheel. The frequency F is given by the following equation:
The inhibition threshold is used to inhibit the SHUTDOWN action and associated
alarms on all binary safety channels (switches). On the general functional schematic
shown in appendix 3, the inhibition is represented by the Enable pin on each Latch
circuit.
The Safety Module monitors the speed sensor and the line. If a sensor fault is
detected a dedicated red LED is turned on and a common output called “Sensor
fault” is activated.
If a speed sensor fault occurs, the computed speed comes down to 0 and the
inhibition condition is reached. In such case, as mentioned above, the SHUTDOWN
action and associated alarms are inhibited even if the engine is still running. To avoid
this behaviour enabling latches when a speed sensor fault is detected can be done
using SW16. Please refer to section 5.5.7 “Inhibition” for further details.
To resume, when the engine speed goes under the inhibition threshold, the
SHUTDOWN action and associated alarms on all binary safety channels are inhibited
except if SW16 allows taking into account a speed sensor fault. This inhibition
threshold is displayed by a yellow Led named Inhibit. When the engine is stopped,
this Led must be turned on.
Each alarm condition is latched as it can disappear. The information of the original
fault is saved by the hardware. Relevant information to be displayed is done after
latch for each channel (see section 5.6). A reset push button located on the back side
of the electronic board allows resetting latches only if alarm conditions have
disappeared.
In case of fault, it is necessary to check carefully the led’s status before reset,
as there is no more memory after reset operation.
5.5.7 Inhibition
• One based on inhibition speed described before. In this case the inhibition is
done before latches and stops all safety alarms, LED activity and shutdown
command. This inhibition can be de-activated when there is a speed sensor
fault, depending on SW16 setting. See remark below.
• One based on an external normally open contact, which inhibits shutdown
action, except for over-speed condition. Note that if a safety condition
appears, the dedicated red LED and duplication status change and the
alarm state is latched. When the inhibition disappear the shutdown action will
be effective as the safety condition latched is still present. It will be
necessary to reset the safety module before removing shutdown
inhibition to prevent engine shutdown.
Remark: when a speed sensor fault is detected, speed value returns 0, thus the
output of the two comparators are in a state corresponding to a stopped engine. To
avoid inhibition of all binary shutdown conditions, latches can be enabled in parallel
by the speed sensor fault.
Because some faults are grouped in the same output, information displayed by the
Safety Module is more accurate than information which can be retrieved by a
monitoring system.
It means that the monitoring system will display a fault which can be sometimes not
detailed. Detailed information will be available looking at the front side of the Safety
Module. In all fault cases, the user must come locally to perform a reset. Locally
displayed information must be checked before resetting the Safety Module.
• Low Engine Oil Pressure Sensor Faulty: Red, Normal: Turned OFF
• Low Gear Oil Pressure Sensor Faulty: Red, Normal: Turned OFF
• High Engine Coolant Temp. Sensor Faulty: Red, Normal: Turned OFF
• Safety Spare #1 Sensor Faulty: Red, Normal: Turned OFF
• Safety Spare #2 Sensor Faulty: Red, Normal: Turned OFF
• Engine Speed Sensor Faulty: Red, Normal: Turned OFF
• Low Engine Oil Pressure Fault after latch: Red, Normal: Turned OFF
• Low Gear oil pressure Fault after latch: Red, Normal : Turned OFF
• High Engine Coolant Temperature Fault after latch: Red, Normal : Turned OFF
• Safety Spare #1 Fault after latch: Red, Normal : Turned OFF
• Safety Spare #2 Fault after latch: Red, Normal : Turned OFF
• Over-speed Fault after latch: Red, Normal : Turned OFF
J3-11
Buzzer / Horn
Pulse at
J3-9
each alarm Stop buzzer
J3-10
SAFETY SYSTEM
6 ENVIRONMENT
To be marine approved, the Safety Module has been designed to comply with the
most restricting rules among all the rules regarding Main Engine safety module
prescribed by five classification societies.
In particular:
• EMI perturbations
• Vibrations
• Climatic requirements
Moreover, Safety Module has been designed in order to accept a temperature range
of – 40 °C to + 85 °C, even if it is not required.
Protection level (IP) is 65 on the front side after mounting with the appropriate
gasket.
SAFETY MODULE does not require any specific settings to be modified by the end
user. However some settings can be potentially available to the end user
SW2 Switch
Located on rear side of the electronic board, it allows to choose between safety mode
(normal) and test mode for over speed. If an overspeed test is required, SW2 must be
placed in the test position. After test completion, SW2 must be switched back to the
Safety position.
Do not modify SW3 to SW12 and SW16 without engine manufacturer or dealer
written authorization.
8 COMMISIONER SETTINGS
The Safety Module requires some initial settings depending on the engine flywheel
and time delays required for each channel.
Trimmer P1, labelled “Over-speed trip setting” allows to set the over-speed
frequency treshold. It can be set from 2450 to 7350 Hertz.
Setting can be done at workshop with only a frequency generator delivering a 8.5
Volts peak sinusoidal wave, avoiding a big test bench with real pick-up sensor.
SW2 allows to choose between safety position, which is the normal one, and test
position.
Safety postion corresponds to a tripping at frequency set with P1 trimmer.
Reset P.B.
Up = test
Trimmer SW2
P1
SW3 to SW12 are used to configure the time delay (persistence) for the five dry
contact inputs :
No time delay TD = 2 s TD = 4 s TD = 8 s TD = 16 s
SW16 allows to select if all safety switch inputs are active or not when a speed
sensor fault occurs.
If SW16 is set on active, all binary channels will trig alarm, and shutdown if their
condition is fault. It means that the engine is always protected. But it also means that
when engine will stop the inhibition based on the engine speed below idle will not
occur. Consequently, safety system will trip for example on engine oil pressure if the
oil pump is geared by the engine itself.
If SW16 is set on “Not active”, all binary channels will never trig an alarm. They are
all inhibited as speed is supposed to be 0 rpm
Active
Not active
SW18 and SW19 allow to respectively set channel spare #1 and chanelle spare #2
as safety channel or alarm channel.
Safety Alarm
SW19
SW18
9 MANUFACTURER SETTINGS
Some parameters are only accessible to CMR. In order to change them, the
hardware must be modified.
Appendix N° 1
Appendix N° 2
Technical specifications
INPUTS
Channel Signal Line monitoring Threshold
Engine speed: pulse yes internal Over speed (1)
Test (2)
1100 Hz (3)
OUTPUT
Relay Normal state Mode Contact / max current / Volt
Shutdown ND Latched 1 DPDT / 5 A / 30 VDC
Common Sensor Fault NE Steady 1 NO / 1 A / 30 VDC
Common Power Supply Fault NE Steady 1 NO / 1 A / 30 VDC
Low Engine Oil Pressure ND Latched 1 SPDT (*) /1 A / 30 VDC
Low Gear Oil Pressure ND Latched 1 SPDT (*) /1 A / 30 VDC
High Engine Coolant temp. ND Latched 1 SPDT (*) /1 A / 30 VDC
Safety Switch Spare #1 ND Latched 1 SPDT (*) /1 A / 30 VDC
Safety Switch Spare #2 ND Latched 1 SPDT (*)/ 1 A / 30 VDC
Over Speed ND Latched 1 NO / 1 A / 30 VDC
Inhibit Status NE (1) Steady 1 NO / 1 A / 30 VDC
Start / Stop Buzzer ND Pulse (400 ms) 1 DPDT / 5 A / 30 VDC
(*): Normally Open or Normally Closed contact selectable by jumper
(1) Relay is energized when engine speed is below sub idle (engine stopped)
ENVIRONMENT
Storage temperature: - 40 / + 85 °C
Operating temperature: 0 / + 70 °C steady
0 / + 85 °C peak (< 24 h)
Relative humidity 95% not condensing at 55 °C
Vibration: Compliant with IEC 60068-2 / Test Fc.
Equipment mounted on the engine (acceleration 4g)
EMI perturbations: According to Marine class rules for engine room location
Appendix N° 3
Appendix N° 4