Rockwell Automation Guardmaster MSR57P User manual

User Manual
(Catalog Number 440R-S845AER-NNL )
Guardmaster MSR57P Speed
Monitoring Safety Relay

Important User Information
Solid state equipment has operational characteristics differing from those of electromechanical equipment. Safety
Guidelines for the Application, Installation and Maintenance of Solid State Controls (publication SGI-1.1 available
from your local Rockwell Automation sales office or online at http://literature.rockwellautomation.com) describes
some important differences between solid state equipment and hard-wired electromechanical devices. Because of
this difference, and also because of the wide variety of uses for solid state equipment, all persons responsible for
applying this equipment must satisfy themselves that each intended application of this equipment is acceptable.
In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting
from the use or application of this equipment.
The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many
variables and requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume
responsibility or liability for actual use based on the examples and diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment,
or software described in this manual.
Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell
Automation, Inc., is prohibited.
Throughout this manual, when necessary, we use notes to make you aware of safety considerations.
Rockwell Automation, Allen-Bradley, TechConnect, Guardmaster, Kinetix, PowerFlex, SCANport, RSLinx, DriveExplorer, and DriveExecutive are trademarks of Rockwell Automation, Inc.
Trademarks not belonging to Rockwell Automation are property of their respective companies.
WARNING Identifies information about practices or circumstances that can cause an explosion in a
hazardous environment, which may lead to personal injury or death, property damage, or
economic loss.
IMPORTANT Identifies information that is critical for successful application and understanding of the product.
ATTENTION Identifies information about practices or circumstances that can lead to personal injury or death,
property damage, or economic loss. Attentions help you identify a hazard, avoid a hazard, and
recognize the consequence
SHOCK HAZARD Labels may be on or inside the equipment, for example, a drive or motor, to alert people that
dangerous voltage may be present.
BURN HAZARD Labels may be on or inside the equipment, for example, a drive or motor, to alert people that
surfaces may reach dangerous temperatures.

3Publication 440R-UM004A-EN-P - December 2008 3
Table of Contents
Preface
About This Publication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Who Should Use This Manual . . . . . . . . . . . . . . . . . . . . . . . . 9
Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Additional Resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Chapter 1
Safety Concept
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Safety Certification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Important Safety Considerations . . . . . . . . . . . . . . . . . . . 14
Safety Category 4 Performance Definition . . . . . . . . . . . . 15
Stop Category Definitions. . . . . . . . . . . . . . . . . . . . . . . . 15
Performance Level and Safety Integrity Level (SIL) 3 . . . . 16
Functional Proof Tests. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
PFD and PFH Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . 16
PFD and PFH Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Safe State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Safety Reaction Time. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Considerations for Safety Ratings . . . . . . . . . . . . . . . . . . . . . 18
Output Pulse Test Considerations . . . . . . . . . . . . . . . . . . 19
Considerations for Single-encoder Applications . . . . . . . . 19
Contact Information if Device Failure Occurs . . . . . . . . . . . . 22
Chapter 2
About the MSR57P Speed
Monitoring Safety Relay
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Safety Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Safety Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Disabled Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Lock Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Safe Maximum Speed, Safe Maximum Acceleration, and
Safe Direction Monitoring. . . . . . . . . . . . . . . . . . . . . . . . 25
Hardware Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Chapter 3
Installation and Wiring
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
General Safety Information . . . . . . . . . . . . . . . . . . . . . . . . . 30
Environment and Enclosure. . . . . . . . . . . . . . . . . . . . . . . . . 31
Considerations for Reducing Noise. . . . . . . . . . . . . . . . . . . . 31
Dimensions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Spacing Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Mount the MSR57P Relay. . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Power Supply Requirements . . . . . . . . . . . . . . . . . . . . . . . . 32
Removable Terminal Blocks . . . . . . . . . . . . . . . . . . . . . . . . 33

4Publication 440R-UM004A-EN-P - December 2008
Table of Contents
Circuit Diagram. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Terminal Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Compatible Encoders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Connect an Encoder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Encoder Cable Specifications . . . . . . . . . . . . . . . . . . . . . . . . 42
Feedback Cable Connections for Kinetix 2000, Kinetix 6000,
Kinetix 7000 and Ultra3000 Drives . . . . . . . . . . . . . . . . . . . . 42
Flying-lead Feedback Cable Pin-outs. . . . . . . . . . . . . . . . 44
Wiring Low-profile Connector Kits . . . . . . . . . . . . . . . . . 51
Feedback Connections for PowerFlex 70 Drives . . . . . . . . . . 52
Safe Off Board Terminal Block
(Enhanced Control Only) . . . . . . . . . . . . . . . . . . . . . . . . 53
Encoder Interface Terminal Block
(Enhanced Control Only) . . . . . . . . . . . . . . . . . . . . . . . . 53
Feedback Connections for PowerFlex 700S Drives . . . . . . . . 55
Connect a Configuration Device . . . . . . . . . . . . . . . . . . . . . 55
Chapter 4
Speed Monitoring I/O Signals
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Inputs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Safe Stop Input (SS_In) . . . . . . . . . . . . . . . . . . . . . . . . . 60
Safe Limited Speed Input (SLS_In) . . . . . . . . . . . . . . . . . 60
Door Monitor Input (DM_In) . . . . . . . . . . . . . . . . . . . . . 60
Enabling Switch Monitor Input (ESM_In). . . . . . . . . . . . . 61
Lock Monitor Input (LM_In) . . . . . . . . . . . . . . . . . . . . . . 61
Reset Input (Reset_In) . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Reset Loop Input (RL_In) . . . . . . . . . . . . . . . . . . . . . . . . 63
Outputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Safety Control Outputs. . . . . . . . . . . . . . . . . . . . . . . . . . 63
Diagnostic Outputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Chapter 5
General Relay and Feedback
Monitoring Configuration
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Cascaded Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Safety Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Reset Type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Reset Qualification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Overspeed Response Time . . . . . . . . . . . . . . . . . . . . . . . . . 75
Speed Resolution Accuracy for Rotary Systems . . . . . . . . 76
Speed Resolution Accuracy for Linear Systems . . . . . . . . 78
Language Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Max Display Speed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
General Parameter List . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Feedback Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Feedback Polarity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

Publication 440R-UM004A-EN-P - December 2008 5
Table of Contents
Single Encoder. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
Dual Encoders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
Feedback Voltage Monitor Range . . . . . . . . . . . . . . . . . . 85
Feedback Fault . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Feedback Parameter List . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Chapter 6
Safe Stop and Safe Stop with Door
Monitoring Modes
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Safe Stop Mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Safe Stop Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Standstill Speed and Position Tolerance . . . . . . . . . . . . . 93
Deceleration Monitoring. . . . . . . . . . . . . . . . . . . . . . . . . 94
Safe Stop Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Door Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Lock Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Safe Stop Parameter List . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Safe Stop Wiring Example . . . . . . . . . . . . . . . . . . . . . . . . . 102
Safe Stop with Door Monitoring Mode . . . . . . . . . . . . . . . . 102
Lock Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
SS Reset. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Safe Stop with Door Monitoring Parameter List. . . . . . . . . . 103
Safe Stop with Door Monitoring Wiring Example . . . . . . . . 104
Chapter 7
Safe Limited Speed (SLS) Modes
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Safe Limited Speed (SLS) Mode . . . . . . . . . . . . . . . . . . . . . 105
Safe Limited Speed Reset . . . . . . . . . . . . . . . . . . . . . . . 107
Safe Limited Speed Parameter List . . . . . . . . . . . . . . . . . . . 108
Safe Limited Speed Wiring Example. . . . . . . . . . . . . . . . . . 109
Safe Limited Speed with Door Monitoring Mode. . . . . . . . . 110
Safe Limited Speed Reset . . . . . . . . . . . . . . . . . . . . . . . 111
SLS with Door Monitoring Parameter List . . . . . . . . . . . . . . 111
SLS with Door Monitoring Wiring Example. . . . . . . . . . . . . 112
Safe Limited Speed with Enabling Switch Monitoring Mode. 112
Safe Stop Reset (SS Reset) and Safe Limited Speed Reset
(SLS Reset) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
SLS with Enabling Switch Monitoring Parameter List . . . . . . 114
SLS with Enabling Switch Monitoring Wiring Example . . . . 115
Safe Limited Speed with Door Monitoring and Enabling
Switch Monitoring Mode . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Behavior During SLS Monitoring. . . . . . . . . . . . . . . . . . 117
Behavior While SLS Monitoring is Inactive . . . . . . . . . . 117
Behavior During SLS Monitoring Delay . . . . . . . . . . . . . 117
Safe Stop Reset (SS Reset) and Safe Limited Speed Reset
(SLS Reset) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118

6Publication 440R-UM004A-EN-P - December 2008
Table of Contents
SLS with Door Monitoring and Enabling Switch Monitoring
Parameter List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
SLS with Door Monitoring and Enabling Switch Monitoring
Wiring Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
Safe Limited Speed Status Only Mode . . . . . . . . . . . . . . . . 119
Speed Hysteresis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
SLS Status Only Parameter List . . . . . . . . . . . . . . . . . . . . . . 121
SLS Status Only Wiring Examples. . . . . . . . . . . . . . . . . . . . 122
Chapter 8
Slave Modes for Multi-axis
Cascaded Systems
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
Cascaded Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . 125
Slave, Safe Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Slave, Safe Stop Parameter List. . . . . . . . . . . . . . . . . . . . . . 127
Slave, Safe Stop Wiring Examples . . . . . . . . . . . . . . . . . . . 129
Slave, Safe Limited Speed Mode. . . . . . . . . . . . . . . . . . . . . 132
Slave, Safe Limited Speed Parameters. . . . . . . . . . . . . . . . . 132
Slave, Safe Limited Speed Wiring Examples . . . . . . . . . . . . 133
Slave, Safe Limited Speed Status Only Mode. . . . . . . . . . . . 135
Slave, Safe Limited Speed Status Only Parameter List . . . . . 135
Slave, Safe Limited Speed Status Only Wiring Examples . . . 135
Multi-axis Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
Cascaded System Examples . . . . . . . . . . . . . . . . . . . . . . . . 139
Chapter 9
Safe Maximum Speed and
Direction Monitoring
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Safe Maximum Speed (SMS) Monitoring. . . . . . . . . . . . . . . 145
Safe Maximum Acceleration (SMA) Monitoring . . . . . . . . . . 148
Safe Direction Monitoring (SDM) . . . . . . . . . . . . . . . . . . . . 150
Max Speed, Max Accel, and Direction Monitoring
Parameter List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
Chapter 10
Safety Configuration and
Verification
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
Safety Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
Configuration Signature ID. . . . . . . . . . . . . . . . . . . . . . 153
Safety-lock. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
Set a Password. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
Reset the Password . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
Reset the Relay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
Basics of Application Development and Testing . . . . . . . . . 156
Commissioning the System . . . . . . . . . . . . . . . . . . . . . . . . 156
Specify the Safety Configuration . . . . . . . . . . . . . . . . . . 157
Configure the Speed Monitoring Relay . . . . . . . . . . . . . 158
Project Verification Test . . . . . . . . . . . . . . . . . . . . . . . . 159

Publication 440R-UM004A-EN-P - December 2008 7
Table of Contents
Confirm the Project . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
Safety Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
Verify the Signature and Lock at the Speed Monitoring
Relay. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
Editing the Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . 160
Chapter 11
Configuration Examples
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
Example Application 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
Example 1: Initial Security Group Settings. . . . . . . . . . . 162
Example 1: General Group Settings . . . . . . . . . . . . . . . 163
Example 1: Feedback Group Settings . . . . . . . . . . . . . . 164
Example 1: Stop Group Settings . . . . . . . . . . . . . . . . . . 166
Example 1: Limited Speed Group Settings. . . . . . . . . . . 168
Example 1: Door Control Group Settings . . . . . . . . . . . 169
Example 1: Max Speed Group . . . . . . . . . . . . . . . . . . . 170
Example 1: Final Security Group Settings . . . . . . . . . . . 171
Example Application 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . 172
Example 2: Initial Security Group Settings. . . . . . . . . . . 173
Example 2: General Group Settings . . . . . . . . . . . . . . . 174
Example 2: Feedback Group Settings . . . . . . . . . . . . . . 175
Example 2: Stop Group Settings . . . . . . . . . . . . . . . . . . 177
Example 2: Limited Speed Group Settings. . . . . . . . . . . 179
Example 2: Door Control Group Settings . . . . . . . . . . . 181
Example 2: Max Speed Group . . . . . . . . . . . . . . . . . . . 182
Example 2: Final Security Group Settings . . . . . . . . . . . 183
Chapter 12
Troubleshoot the MSR57P Relay
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
Status Indicators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
Nonrecoverable Faults. . . . . . . . . . . . . . . . . . . . . . . . . . . . 186
Fault Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187
Input and Output Faults . . . . . . . . . . . . . . . . . . . . . . . . . . 187
Fault Codes and Descriptions . . . . . . . . . . . . . . . . . . . . . . 187
Fault Reactions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
Safe State Faults. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
Stop Category Faults and Fault While Stopping Faults . . 191
Status Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192
Guard Status Attributes. . . . . . . . . . . . . . . . . . . . . . . . . 192
I/O Diagnostic Status Attributes . . . . . . . . . . . . . . . . . . 195
Configuration Fault Codes . . . . . . . . . . . . . . . . . . . . . . . . . 196

8Publication 440R-UM004A-EN-P - December 2008
Table of Contents
Appendix A
Specifications
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197
General Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197
Environmental Specifications . . . . . . . . . . . . . . . . . . . . . . . 198
Certifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199
Encoder Specifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . 199
Appendix B
Parameter Data
Parameter Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201
Parameters and Settings in a Linear List . . . . . . . . . . . . . . . 202
Appendix C
Using a HIM
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
Connect a HIM Module . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
Setting Parameters with a HIM Module. . . . . . . . . . . . . . . . 214
Accessing the Fault History Queue. . . . . . . . . . . . . . . . . . . 215
Appendix D
Use DriveExplorer or
DriveExecutive Software
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
Connect a Personal Computer . . . . . . . . . . . . . . . . . . . . . . 217
Using DriveExplorer Software . . . . . . . . . . . . . . . . . . . . . . 218
Configure Serial Communication. . . . . . . . . . . . . . . . . . 218
Edit Parameters in DriveExplorer Software . . . . . . . . . . 219
Access the Fault History Queue . . . . . . . . . . . . . . . . . . 220
Using DriveExecutive Software . . . . . . . . . . . . . . . . . . . . . 221
Configure Serial Communication. . . . . . . . . . . . . . . . . . 221
Edit Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224
Appendix E
Application Examples
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
PowerFlex 70 Drive with Safe-Off Application Example . . . 228
PowerFlex 700 Drive without Safe-Off . . . . . . . . . . . . . . . . 231
Kinetix 6000 or Kinetix 7000 Drives with Safe-off Example . 233
Kinetix 2000 Drive without Safe-off Example . . . . . . . . . . . 235
Index

9Publication 440R-UM004A-EN-P - December 2008 9
Preface
About This Publication
This manual explains how the Guardmaster MSR57P Speed Monitoring
Safety Relay can be used in Safety Integrity Level (SIL) 3, Performance
Level [PL(e)], or Category (CAT) 4 applications. It describes the safety
requirements, including PFD and PFH values and application
verification information, and provides information on installing,
configuring, and troubleshooting the relay.
Who Should Use This
Manual
Use this manual if you are responsible for designing, installing,
configuring, or troubleshooting safety applications that use the
MSR57P Speed Monitoring Safety Relay.
You must have a basic understanding of electrical circuitry and
familiarity with relay logic. You must also be trained and experienced
in the creation, operation, and maintenance of safety systems.
Conventions
In this manual, configuration parameters are listed by number
followed by the name in brackets. For example,
P24 [OverSpd Response].
Terminology
The following table defines terms used in this manual.
Terminology
Abbreviation Full Term Definition
1oo2 One out of Two Refers to the behavioral design of a dual-channel safety system.
CAT Category
DC Door Control —
DM Door Monitoring —
EN European Norm The official European Standard.
ESM Enabling Switch Monitoring —
ESPE Electro-sensitive Protective
Equipment An assembly of devices and/or components working together for protective tripping or presence-sensing purposes and comprising as a minimum:
•a sensing device.
•controlling/monitoring devices.
•output signal-switching devices (OSSD).
FMEA Failure Mode and Effects Analysis Analysis of potential failure modes to determine the effect upon the system
and identify ways to mitigate those effects.
IEC International Electrotechnical
Commission —

10 Publication 440R-UM004A-EN-P - December 2008
Preface
IGBT Insulated Gate Bi-polar Transistor —
HFT Hardware Fault Tolerance The HFT equals n, where n+1 faults could cause the loss of the safety function.
An HFT of 1 means that 2 faults are required before safety is lost.
HIM Human Interface Module A module used to configure a device.
LM Lock Monitoring —
MP Motion Power —
OSSD Output Signal Switching Device The component of the electro-sensitive protective equipment (ESPE) connected
to the control system of a machine, which, when the sensing device is
actuated during normal operation, responds by going to the OFF-state.
PC Personal Computer Computer used to interface with and program your safety system.
PFD Probability of Failure on Demand The average probability of a system to fail to perform its design function on
demand.
PFH Probability of Failure per Hour The probability of a system to have a dangerous failure occur per hour.
PL Performance Level ISO 13849-1 safety rating
RL Reset Loop —
SDM Safe Direction Monitoring —
SFF Safe Failure Fraction The sum of safe failures plus the sum of dangerous detected failures divided
by the sum of all failures.
SIL Safety Integrity Level A measure of a products ability to lower the risk that a dangerous failure could
occur.
SLS Safe Limited Speed —
SMA Safe Maximum Acceleration —
SMS Safe Maximum Speed —
SS Safe Stop —
Terminology
Abbreviation Full Term Definition

Publication 440R-UM004A-EN-P - December 2008 11
Preface
Additional Resources
This table lists publications that contain important information about
safety systems that can use the speed monitoring safety functions of
the MSR57P relay.
You can view or download publications at:
http://literature.rockwellautomation.com . To order paper copies of
technical documentation, contact your local Rockwell Automation
distributor or sales representative.
Resource Description
Guardmaster MSR57P Speed Monitoring Safety Relay Installation
Instructions, publication
440R-IN016
Provides information on installing the MSR57P relay.
HIM Quick Reference, publication
20HIM-QR001 A quick reference for using the HIM keypad.
DriveExplorer Online Help DriveExplorer online help provides information on the release, quick
start steps, general information about DriveExplorer software,
descriptions of the elements in the DriveExplorer window, step-by-step
procedures, and troubleshooting information.
PowerFlex USB Converter User Manual, publication
DRIVES-UM001
Provides detailed information on installing, configuring, and
troubleshooting the 1203-USB converter.
PowerFlex Smart Self-powered Serial Converter User Manual,
publication
20COMM-UM001
Provides detailed information on installing, configuring, and
troubleshooting the 1203-SSS series B serial converter.
PowerFlex 700S Phase II Drive User Manual, publication
20D-UM006
Provides detailed information on installing, wiring, programming, and
troubleshooting PowerFlex 700S Phase II drives.
PowerFlex 700 Series A User Manual, publication
20B-UM001 Provides detailed information on installing, wiring, programming, and
troubleshooting PowerFlex 700 Series A drives.
PowerFlex 700 Series B User Manual, publication
20B-UM002 Provides detailed information on installing, wiring, programming, and
troubleshooting PowerFlex 700 Series B drives.
PowerFlex 70 User Manual, publication
20A-UM001 Provides detailed information on installing, wiring, programming, and
troubleshooting PowerFlex 70 drives.
PowerFlex Reference Manual, publication
PFLEX-RM001 Provides specifications and dimensions, as well as detailed information
about drive operation.
DriveGuard Safe-Off Option (Series B) for PowerFlex 40P and 70
AC Drives User Manual, publication
PFLEX-UM003
Provides detailed information installing, wiring, and operating
PowerFlex 70 AC drives with the Safe-Off option. The manual also
includes certification information for the Safe-Off option.
Kinetix 6000 Multi-axis Servo Drive User Manual, publication
2094-UM001
Provides detailed information on installing, connecting, configuring, and
troubleshooting a Kinetix 6000 drive. The manual also includes
specifications and dimensions.
Kinetix Safe-off Feature Safety Reference Manual, publication
GMC-RM002
Provides detailed information on the safety requirements, as well as
connector and wiring diagrams for the Safe-off feature.
Kinetix Motion Control Selection Guide, publication
GMC-SG001 Provides features, specifications, and dimensions for selecting Kinetix
Motion Control servo drives, motors, actuators, and accessory
components.
Ultra3000 Digital Servo Drives Installation Manual, publication
2098-IN003
Provides information on installing and wiring for the Ultra3000 Digital
Servo Drives.
Ultra3000 Digital Servo Drives Integration Manual, publication
2098-IN005
Provides power-up procedures, system integration, and troubleshooting
tables for the Ultra3000 Digital Servo Drives.
Safety Guidelines for the Application, Installation and
Maintenance of Solid State Control, publication
SGI-1.1
Describes important differences between solid state control and
hard-wired electromechanical devices.

12 Publication 440R-UM004A-EN-P - December 2008
Preface

13Publication 440R-UM004A-EN-P - December 2008 13
Chapter 1
Safety Concept
Introduction
This chapter describes the safety performance level concept and how
the MSR57P Speed Monitoring Safety Relay can meet the requirements
for SIL CL3, PL(e), or CAT 4 applications.
Safety Certification
The MSR57P Speed Monitoring Safety Relay is certified for use in
safety applications up to and including SIL CL3 according to IEC 61508
and EN 62061, Performance Level PL(e) and CAT 4 according to
ISO 13849-1. Safety requirements are based on the standards current
at the time of certification.
The TÜV Rheinland group has approved the MSR57P Speed
Monitoring Safety Relay for use in safety-related applications where
the de-energized state is considered to be the safe state. All of the
examples related to I/O included in this manual are based on
achieving de-energization as the safe state for typical Machine Safety
and Emergency Shutdown (ESD) systems.
Topic Page
Safety Certification 13
Functional Proof Tests 16
PFD and PFH Definitions 16
PFD and PFH Data 17
Safe State 17
Safety Reaction Time 18
Considerations for Safety Ratings 18
Contact Information if Device Failure Occurs 22

14 Publication 440R-UM004A-EN-P - December 2008
Chapter 1 Safety Concept
Important Safety Considerations
The system user is responsible for:
•the set-up, safety rating, and validation of any sensors or
actuators connected to the system.
•completing a system-level risk assessment and reassessing the
system any time a change is made.
•certification of the system to the desired safety performance
level.
•project management and proof testing.
•programming the application software and the device
configurations in accordance with the information in this
manual.
•access control to the system, including password handling.
•analyzing all configuration settings and choosing the proper
setting to achieve the required safety rating.
IMPORTANT When applying Functional Safety, restrict access to qualified,
authorized personnel who are trained and experienced.
ATTENTION When designing your system, consider how personnel will exit
the machine if the door locks while they are in the machine.
Additional safeguarding devices may be required for your
specific application.
ATTENTION A HIM module may be used to configure and monitor the
MSR57P speed monitoring safety relay. However, the stop
button on the HIM does not have safety integrity and must not
be used to execute a safe stop.
The stop button setting is not maintained through a power
cycle. Do not use the stop button in conjunction with an
Automatic Reset configuration. Unintended motion could result.

Publication 440R-UM004A-EN-P - December 2008 15
Safety Concept Chapter 1
Safety Category 4 Performance Definition
To achieve Safety Category 4 according to ISO 13849-1:2006, the
safety-related parts have to be designed such that:
•the safety-related parts of machine control systems and/or their
protective equipment, as well as their components, shall be
designed, constructed, selected, assembled, and combined in
accordance with relevant standards so that they can withstand
expected conditions.
•basic safety principles shall be applied.
•a single fault in any of its parts does not lead to a loss of safety
function.
•a single fault is detected at or before the next demand of the
safety function, or, if this detection is not possible, then an
accumulation of faults shall not lead to a loss of the safety
function.
•the average diagnostic coverage of the safety-related parts of the
control system shall be high, including the accumulation of
faults.
•the mean time to dangerous failure of each of the redundant
channels shall be high.
•measures against common cause failure shall be applied.
Stop Category Definitions
The selection of a stop category for each stop function must be
determined by a risk assessment.
•Stop Category 0 is achieved with immediate removal of power to
the actuator, resulting in an uncontrolled coast to stop. Safe
Torque Off accomplishes a Stop Category 0 stop.
•Stop Category 1 is achieved with power available to the machine
actuators to achieve the stop. Power is removed from the
actuators when the stop is achieved.
•Stop Category 2 is a controlled stop with power available to the
machine actuators. The stop is followed by a holding position
under power.
IMPORTANT When designing the machine application, timing and distance
should be considered for a coast to stop (Stop Category 0 or
Safe Torque Off). For more information regarding stop
categories, refer to EN 60204-1.

16 Publication 440R-UM004A-EN-P - December 2008
Chapter 1 Safety Concept
Performance Level and Safety Integrity Level (SIL) 3
For safety-related control systems, Performance Level (PL), according
to ISO 13849-1, and SIL levels, according to IEC 61508 and EN 62061,
include a rating of the system’s ability to perform its safety functions.
All of the safety-related components of the control system must be
included in both a risk assessment and the determination of the
achieved levels.
Refer to the ISO 13849-1, EN 61508, and EN 62061 standards for
complete information on requirements for PL and SIL determination.
See Chapter 10, Safety Configuration and Verification, for more
information on the requirements for configuration and verification of a
safety-related system containing the MSR57P Speed Monitoring Safety
Relay.
Functional Proof Tests
The functional safety standards require that functional proof tests be
performed on the equipment used in the system. Proof tests are
performed at user-defined intervals and are dependent upon PFD and
PFH values.
PFD and PFH Definitions
Safety-related systems can be classified as operating in either a Low
Demand mode, or in a High Demand/Continuous mode.
•Low Demand mode: where the frequency of demands for
operation made on a safety-related system is no greater than one
per year or no greater than twice the proof-test frequency.
•High Demand/Continuous mode: where the frequency of
demands for operation made on a safety-related system is greater
than once per year or greater than twice the proof test interval.
The SIL value for a low demand safety-related system is directly
related to order-of-magnitude ranges of its average probability of
failure to satisfactorily perform its safety function on demand or,
simply, average probability of failure on demand (PFD). The SIL value
for a High Demand/continuous mode safety-related system is directly
related to the probability of a dangerous failure occurring per hour
(PFH).
IMPORTANT Your specific application determines the time frame for the
proof test interval.

Publication 440R-UM004A-EN-P - December 2008 17
Safety Concept Chapter 1
PFD and PFH Data
These PFD and PFH calculations are based on the equations from
Part6 of EN 61508 and show worst-case values.
This table provides data for a 20-year proof test interval and
demonstrates the worst-case effect of various configuration changes
on the data.
Safe State
The Safe State encompasses all operation that occurs outside of the
other monitoring and stopping behavior defined as part of the speed
monitoring safety relay. In addition, configuration takes place in the
Safe State. While the relay is in the Safe State, all safety control
outputs, except the Door Control (DC_Out) output, are in their safe
state (de-energized). The Door Control (DC_Out) output will be in
either the locked state or in the de-energized state depending upon
the condition that resulted in the safe state.
The diagnostic Fault_Status output may be on in the safe state.
When you cycle power, the relay enters the Safe State for self-testing.
If the self-tests pass and there is a valid configuration, the relay
remains in the Safe State until a successful request for safe speed
monitoring occurs.
If a Safe State Fault is detected, the relay goes to the Safe State. This
includes faults related to integrity of hardware or firmware.
For more information on faults, see Chapter 12, Troubleshoot the
MSR57P Relay.
PFD and PFH for 20-year Proof Test Interval
Attribute Pulse Test ON Pulse Test OFF(1)
(1) Pulse testing for outputs is configured using the following parameters: P71 [MP Out Mode], P72 [SS Out Mode],
P73 [SLS Out Mode], P74 [Door Out Mode]. If you disable pulse-testing on any of these outputs, the achievable
SIL, Category, and PL ratings of your entire MSR57P safety system are reduced. See Outputs beginning on page
63 for more information.
Single Encoder Dual Encoder
PFD 1.23E - 04 5.93E-04 25.9E-04
PFH 7.04E-09 3.38E-09 14.8E-09
SFF 99.3% 99.2% 97.9%

18 Publication 440R-UM004A-EN-P - December 2008
Chapter 1 Safety Concept
Safety Reaction Time
The safety reaction time is the amount of time from a safety-related
event as input to the system until the system is in the Safe State.
The safety reaction time from an input signal condition that triggers a
safe stop, to the initiation of the configured Safe Stop Type, is 20 ms
(maximum).
The safety reaction time from an overspeed event that triggers a safe
stop, to the actual initiation of the configured Safe Stop Type, is equal
to the value of the P24 [OverSpd Response] parameter.
For more information on overspeed response time, see Overspeed
Response Time on page 75.
Considerations for Safety
Ratings
The achievable safety rating of an application using the MSR57 relay is
dependent upon many factors, including the encoder setup, drive
options, output pulse testing, and the type of motor.
When using two independent encoders to monitor motion and when
installed in a manner to avoid any common cause dangerous failure,
the MSR57P relay can be used in applications up to and including
SIL CL3, PL(e), and CAT 4.
When using a drive with the Safe-Off option and one external
contactor, or when using two external contactors, the MSR57P relay
can be used in applications up to and including SIL CL3, PL(e), and
CAT 4.
IMPORTANT Some of the diagnostics performed on the encoder signals
require motion to detect faults. You must make sure that motion
occurs at least once every six months.

Publication 440R-UM004A-EN-P - December 2008 19
Safety Concept Chapter 1
Output Pulse Test Considerations
If the pulse testing of any safety output is disabled, the maximum
safety rating will be up to and including SIL CL2, PL(d), and CAT 3 for
any safety chain incorporating any input or output of the MSR57P relay.
You may need to disable pulse-testing if the connected device does
not support OSSD inputs. Refer to the product documentation for your
connected device.
Considerations for Single-encoder Applications
When configured correctly, the MSR57P relay performs these
diagnostics on the encoder:
•Sin2+ Cos2diagnostic.
•detection of open or short-circuit.
•encoder supply voltage monitoring.
•detection of illegal quadrature transitions of the sine and cosine
signals.
A safety rating up to and including SIL CL3, PL(e), and CAT 4 can be
achieved in a single-encoder application with these requirements:
•The motor is a permanent magnet (PM) brushless AC motor.
•The motor controller must be configured as a closed-loop
application with field-oriented control using the single-encoder
for commutation.
•The motor-to-encoder coupling is designed to exclude shaft
slippage as a dangerous failure mechanism.
•The MSR57P relay is configured for Sin/Cos encoder type.
IMPORTANT Setting any of the P71 [MP_Out Mode], P72 [SS_Out Mode],
P73 [SLS_Out Mode], or P74 [DC_Out Mode] parameters to 1 =
No Pulse Test disables internal diagnostics as well as external
diagnostics required to achieve higher safety ratings.
You must exercise the SS_In input at least once every six
months.

20 Publication 440R-UM004A-EN-P - December 2008
Chapter 1 Safety Concept
•The encoder is of the Sin/Cos type and is suitable for the desired
safety rating of the application.
An encoder that is suitable for SIL CL3 applications must:
–use independent Sine/Cosine signals.
–be incapable of producing simulated signals when under an
error condition.
–use simple or discreet circuitry with no complex or
programmable internal devices.
•The controller is not configured for auto transition to
encoderless commutation in the event of encoder failure.
•The motor controller must use the same encoder signals as
MSR57P relay.
•Encoder voltage monitoring in MSR57P relay must be enabled.
•The system design of the motor/encoder-to-load coupling
excludes shaft slippage and breakage as a dangerous failure
mechanism.
Single-encoder with Kinetix Drive
A safety rating up to and including SIL CL3, PL(e), and CAT 4 can be
achieved in an MSR57P relay single-encoder application when the
relay is used in conjunction with a properly-configured Kinetix Servo
Drive with Safe-Off and any motor/encoder combination that meets
the single-encoder application requirements on page 19.
Single-encoder with PowerFlex Drive
A safety rating up to and including SIL CL3, PL(e), and CAT 4 can be
achieved in an MSR57P relay single-encoder application when the
relay is used in conjunction with a properly-configured
PowerFlex 700S or PowerFlex 755 drive and any motor/encoder
combination that meets the single-encoder application requirements
on page 19.