schmersal PROTECT-PSC User manual

Instruction Manual PROTECT-PSC
V 2.6R01 / 04.19
Programmable
Safety Controller
K.A. Schmersal GmbH & Co. KG
B
i
t
t
e
M
a
k
r
Version V 2.6R01 / 04.19
-- Translation of the original Instruction Manual --

Instruction Manual PROTECT-PSC
V 2.6R01 / 04.19
This instruction manual is protected by copyright.
All rights reserved also to the translation, reprint and reproduction of the document or parts thereof. No part
of this instruction manual may be reproduced or processed, copied or disseminated using electronic systems
in any form (photocopy, microfilm or a different procedure), also not for purposes of teaching, without the
written consent of K.A. Schmersal GmbH & Co. KG.

Instruction Manual PROTECT-PSC
V 2.6R01 / 04.19
Preface
Thank you for deciding in favour of our Programmable Safety Controller..
This instruction manual contains the description of PROTECT-PSC modules,
POWER modules, as well as the program description of the programming software
PROTECT-PSCsw.
Descriptions, control technical correlations, details on external control units, instal-
lation and operating information or similar have been provided to the best of our
knowledge. However, this does not mean that you may assume warranted charac-
teristics or other properties under liability law which extend beyond the “General
Terms of Delivery for Products and Services of the Electrical Industry”. We trust
you will understand that the user must therefore check our information and recom-
mendations before using the equipment.
In order to guarantee the safe operation of the product, these and all associated
instruction manuals must be read thoroughly and understood. They must be stored
in a safe place after reading and be accessible at the workplace at any time.
Please ensure that this instruction manual is made accessible to the end users of
the equipment.
We reserve the right to modify specifications and similar for the purpose of tech-
nical extension / improvement.
We would like to point out that under provisions of the law on foreign currency and
commercial transactions an export approval is to be obtained from the Japanese
government for the export of products and services for strategic use.
In the event of a defect occurring within the warranty period for which the manufac-
turer is responsible the repair or replacement of the defective part shall be pre-
formed at our discretion and at our expense. We trust you will understand that the
manufacturer is not liable for damage of a direct or indirect nature for which others
are responsible.
The reproduction of names, trade names, trademarks, etc. in this instruction man-
ual even if not especially marked as such, shall not entitle the user to assume that
such names are viewed as free within the meaning of trademark and brand name
protection law and may therefore be used by anyone.
Subject to technical amendments and error. The data used in this document are
carefully checked typical standard values.

Table of Contents
Instruction Manual PROTECT-PSC
V 2.6R01 / 04.19
Table of Contents
1Overview 1–1
1.1 Preface 1–2
1.2 Definition of terms 1–2
1.3 Structure of the document 1–3
1.4 Product description 1–4
1.5 Mode of operation 1–6
1.6 Safety function 1–7
1.7 Performance Level 1–7
1.8 Safety Integrity Level 1–10
1.9 Calculation example 1–12
2Important information 2–1
2.1 Safety warnings 2–2
2.2 Correct use 2–6
2.3 Information on basic handling 2–11
3System description 3–1
3.1 Overview 3–3
3.2 Channel overview 3–5
3.3 ID code of the modules / Module Version 3–6
3.4 PROTECT-PSC operating modes 3–21
3.5 Power supply 3–23
3.6 PSC-Base 3–26
3.7 PSC-CPU-MON / PSC-CPU-OP-MON 3–27
3.8 Input modules 3–41
3.9 Output modules 3–45
3.10 PSC-SUB-MON 3–48
3.11 Combined modules 3–51
3.12 Input modules 3–60
3.13 Relay module 3–66
3.14 Semi-conductor output module 3–69
3.15 Operational input 3–72
3.16 Operational output 3–73
3.17 Operational input module 3–74
3.18 Operational output module 3–77

Table of Contents
Instruction Manual PROTECT-PSC
V 2.6R01 / 04.19
4Installation / project planning 4–1
4.1 Assembly 4–2
4.2 Wiring 4–5
4.3 Circuitry examples 4–12
1.1 O-P Fehler! Textmarke nicht definiert.
1.2 M1 Fehler! Textmarke nicht definiert.
1.3 M2 Fehler! Textmarke nicht definiert.
1.4 M3 Fehler! Textmarke nicht definiert.
1.5 M4 Fehler! Textmarke nicht definiert.
1.6 M5 Fehler! Textmarke nicht definiert.
1.7 M6 Fehler! Textmarke nicht definiert.
1.8 M7 Fehler! Textmarke nicht definiert.
1.9 M8 Fehler! Textmarke nicht definiert.
1.10 O-P Fehler! Textmarke nicht definiert.
1.11 M1 Fehler! Textmarke nicht definiert.
1.12 M2 Fehler! Textmarke nicht definiert.
1.13 M3 Fehler! Textmarke nicht definiert.
1.14 M4 Fehler! Textmarke nicht definiert.
1.15 M5 Fehler! Textmarke nicht definiert.
1.16 M6 Fehler! Textmarke nicht definiert.
1.17 M7 Fehler! Textmarke nicht definiert.
1.18 M8 Fehler! Textmarke nicht definiert.
1.19 O-P Fehler! Textmarke nicht definiert.
1.20 M1 Fehler! Textmarke nicht definiert.
1.21 M2 Fehler! Textmarke nicht definiert.
1.22 M3 Fehler! Textmarke nicht definiert.
1.23 M4 Fehler! Textmarke nicht definiert.
1.24 M5 Fehler! Textmarke nicht definiert.
1.25 M6 Fehler! Textmarke nicht definiert.
1.26 M7 Fehler! Textmarke nicht definiert.
1.27 M8 Fehler! Textmarke nicht definiert.
5Operating mode 3 5–1
5.1 Overview 5–2
5.2 Project planning 5–2
6Programming / parameter assignment 6-1
6.1 Overview 6-4
6.2 Functionality 6-5
6.3 System requirements 6-5
6.4 Installation 6-6
6.5 Password protection 6-6

Table of Contents
Instruction Manual PROTECT-PSC
V 2.6R01 / 04.19
6.6 PIN Code 6-10
6.7 Program/data transfer 6-11
6.8 Program description 6-15
6.9 Parameter assignment 6-23
6.10 Programming 6-31
6.11 Program examples 6-53
6.12 Library / Function block 6-62
6.13 Checking 6-84
6.14 User Program Change Procedure 6-93
6.15 Changing / revising 6-100
6.16 Monitoring 6-105
6.17 Documenting 6-108
6.18 Program options 6-111
6.19 CPU initialisation 6-116
6.20 Engineering Tool Version Maintenance (updating) 6-116
7Operation and maintenance 7-1
7.1 Delivery status 7-2
7.2 Start-up 7-2
7.3 Disturbances/error messages 7-3
7.4 Maintenance 7-8
7.5 Service 7-8
8Annex 8-1
8.1 Technical data 8-2
8.2 Considered standards 8-4
8.3 EC Type-Examination certificate 8-5
8.4 Declarations of conformity 8-6
8.5 Index 8-7

Overview
1
Instruction Manual PROTECT-PSC
V 2.6R01 / 04.19
1–1
1 Overview
This chapter describes the structure of the instruction manual, the basic mode of
operation and the structure of the PROTECT-PSC Sicherheits-Kleinsteuerung.
1.1 Preface 1–2
1.2 Definition of terms 1–2
1.3 Structure of the document 1–3
1.3.1 Page lay-out 1–3
1.3.2 Explanation of symbols 1–4
1.4 Product description 1–4
1.4.1 Overview of the modules 1–5
1.4.2 Brief data 1–5
1.4.3 Area of use 1–6
1.5 Mode of operation 1–6
1.5.1 Hardware 1–6
1.5.2 Software 1–6
1.6 Safety function 1–7
1.7 Performance Level 1–7
1.7.1 Risk graph 1–8
1.7.2 Determining the Performance Level 1–8
1.8 Safety Integrity Level 1–10
1.9 Calculation example 1–12
1.9.1 Performance Level 1–12
1.9.2 SIL with high demand rate 1–12
1.9.3 SIL with low demand rate 1–12

Overview
1
Instruction Manual PROTECT-PSC
V 2.6R01 / 04.19
1–2
1.1 Preface
We have prepared this document with due care to the best of our knowledge and
belief. Despite careful checking the possibility of it containing one or two errors
cannot be ruled out, however.
Before reading this instruction manual thoroughly, please read through chapter 2
carefully. Understanding the information and procedures described in this chapter
is essential for the correct use of the PROTECT-PSC Sicherheits-Kleinsteuerung
described in the following. Please always remember that faulty installation or pro-
gramming can lead to serious injuries / damage to man and machine.
The terms and abbreviations used in this document are standard terms used in
electrical engineering insofar as not described in more detail.
The basic operating functions of a computer with Microsoft Windows operating sys-
tem (as from Windows 2000) are assumed as generally known.
1.2 Definition of terms
The definition of the terms and the abbreviations used most frequently in this doc-
ument are described below.
Module In this document a module is described as an individual
physical unit which is a part of the PROTECT-PSC.
Active module A module which is actively involved in the change of state
of the PROTECT-PSC (corresponding to active
components in electronics).
Assembly An assembly consists of several individual modules.
Channel A physical input or output of a module.
A Contact Designation of an N/O contact
B Contact Designation of an N/C contact
User program The control program of the PROTECT-PSC created by
the programmer.
PS Programm Safety user program for CPU module (see chapter 3.7)
and Safety Input/Output modules.
PN Programm User program for non safe (operational) applications in
CPU module (see chapter 3.7) used with operational In-
put/Output modules.
PSV The PSV (Program Specific Value) is the checksum of
the user program.
FirmwareFB Safe function block inside the PROTECT-PSC
FB library Library of function blocks.
authorized person Person from group described in chapter 2.1.4.
Cat Abbreviation of Category (B, 1 to 4 according to
ISO 13849-1).
PL Performance Level. See ISO 13849-1.
SIL Safety Integrity Level. See IEC 61508.

Overview
1
Instruction Manual PROTECT-PSC
V 2.6R01 / 04.19
1–3
1.3 Structure of the document
This manual is subdivided into 9 chapters. There is an additional table of contents
preceding every chapter in which the individual sections are shown separately.
1.3.1 Page lay-out
All pages have the same lay-out in principle.
F
Fi ig gu ur re e 1 1- -1 1 P Pa ag ge e l la ay y- -o ou ut t o of f t th he e d do oc cu um me en nt t
Headline
The number and the name of the respective chapter are located top right and top
left respectively.
Baseline
The document name, version number and creation date are located bottom left.
The page number within the chapter is shown bottom right.
Margin
This area contains important information, cross-references to other parts of the text
and bibliographic references and the information content of text passages.
Texts / Pictures / Tables
Texts, pictures and tables are named within a chapter with the chapter number and
an additional index and, if necessary, a brief accompanying text.





Overview
1
Instruction Manual PROTECT-PSC
V 2.6R01 / 04.19
1–4
1.3.2 Explanation of symbols
Safety warnings
Text passages with a STOP symbol contain important warnings which must be
heeded under all circumstances. Failure to heed these warnings may place the
controller in a state which no longer provides adequate protection for man and/or
machine. Please read through such text sections with particular care.
Warnings
A CAUTION sign gives you important information and warnings which guarantee
the trouble-free operation of the PROTECT-PSC when heeded. Failure to heed
these warnings does not restrict the safe operation of the PROTECT-PSC.
Information
This symbol indicates useful additional information intended to facilitate the
commissioning/servicing of the PROTECT-PSC or to provide a deeper insight into
the mode of operation of the controller.
Cross references
This symbol refers to other text passages within the document which contain
additional information. The first digit describes the chapter and the second the
page within the chapter.
Additional Information
This symbol refers to external literature containing additional information on a par-
ticular theme. You will find the exact title of the additional literature in the appendix
(Chapter 8.5) by means of the number beside the symbol.
1.4 Product description
The PROTECT-PSC is a modular programmable safety field bus controller. It
serves to monitor and control safety equipment. In connection with safety-
orientated sensors/actuators it complies with the Performance Level (PL) e, Cate-
gory 4 to ISO 13849-1. It can only be used in systems in which the safe state is
synonymous with a de-energized state. It can be used to replace virtually all
circuitry so far used in relay technology.
CPU module can control up to 15 Safety Input/Output modules and operational In-
put/Output modules (Maximum of 254 channels). But, only safety input/output
modules can not consist 15 modules. (In case of only consists of safety in-
put/output module, 14 modules maximum)
The PROTECT-PSC is intended for use in control circuits to IEC 60204 for a rated
voltage of 24 VDC. The appropriate shock-hazard protection requirements must be
met for the applications.
x.x.x / x-xx
x.x.x / xx

Overview
1
Instruction Manual PROTECT-PSC
V 2.6R01 / 04.19
1–5
1.4.1 Overview of the modules
The PROTECT-PSC system essentially consists of the following modules:
POWER Modul, produces 3.3VDC from 24VDC and provides to CPU and In-
put/Output modules (PSC-Power, PSC-Booster).
CPU module, responsible for processing the user program and controlling the
input/output modules (PSC-CPU-OP-MON, PSC-CPU-MON ).
Input/output modules to record/control the states of externally connected
sensors/actuators (PSC-SUB-MON, PSC-S-STP-E, PSC-S-STP-LC, PSC-S-STP-
ELC, PSC-S-IN-E, PSC-S-IN-LC, PSC-S-OUT, PSC-S-Relais)
Non-Safety Input/Output modules to record/control the states of externally
connected sensors/actuators (PSC-NS-IN, PSC-NS-OUT+)
All the above mentioned modules (with the exception of the back plane) have a
redundant structure with two 16 bit microcontrollers monitoring each other.
1.4.2 Brief data
•Can be used in applications up to PL e, category 4 to ISO 13849-1.
•In operating mode 3 programming can be done by ladder diagram (conform-
ing to IEC 61131).
•Programming by means of Windows PC via USB interface
•Safety and standard Inputs/Outputs are available in mode 3.
•A maximum of 254 Input/Output channels are available.
•Possibility to store documentation / comments.
•Monitored 24 VDC power supply .
•Input/output modules with self-monitoring.
•Connection facilities:
Sensor level: EMERGENCY-OFF (EMERGENCY-STOP), AOPD, BNS,
protective guards, two- hand-operating panels…
Actuator level: Relays, contactors, signal/indicator lamps...

Overview
1
Instruction Manual PROTECT-PSC
V 2.6R01 / 04.19
1–6
1.4.3 Area of use
The PROTECT-PSC has been developed particularly for use in small plants.
The PROTECT-PSC can be used in applications up to Performance Level (PL) e,
Category 4 to ISO 13849-1 or the Safety Integrity Level 3 (SIL) to IEC 61508 in
which the safe state is the deenergized state.
The PROTECT-PSC is intended for use in control circuits to IEC 60204 for a rated
voltage for 24 VDC. The appropriate shock-hazard protection requirements are to
be met in the applications.
1.5 Mode of operation
1.5.1 Hardware
CPU module and Safety Input/Output modules consists of two systems working
independently of each other. Each system is controlled by a microprocessor. The
systems monitor each other. In the case of a 2–channel connection, the individual
channels are each monitored by a microprocessor. Self-monitoring enables all
internal defects to safety-relevant components to be detected within the module.
Each module performs a complete self-test at regular intervals.
Non-Safety Input/Output modules consists of one systems. A system is controlled
by a microprocessor.
1.5.2 Software
The programmer creates the user program in the form of a ladder diagram (to IEC
61131) using the PROTECT-PSCsw programming software. For purposes of
verification the ladder diagram is converted to a statement list. After having been
checked by the programmer supported by the programming software the user
program is translated into a format which can be read by the processor module and
can then be transferred to the processor module via a USB interface.
After successful transfer to the processor module the latter sends the user program
back to the programming software for checking. After comparing it with the
transmitted program the user program is released for operation..
During ongoing operation the processor module compares its data with the states
of the Input modules and reacts with the appropriate instructions for the Output
modules, depending on the stored user program.
CPU module and Safety Input/Output modules guarantee a safe switching of the
desired output (switching off all outputs in the case of errors) within 37.6 ms (Mode
3) or 67.6 ms (Mode 1), each including an assumed relay release time of 15 ms.
In case of error the operational outputs are switched off.

Overview
1
Instruction Manual PROTECT-PSC
V 2.6R01 / 04.19
1–7
1.6 Safety function
The safety functions realised by the PROTECT-PSC are defined as follows.
1. A two channel safety input is read. The PS program running in the CPU module
controls the state of the outputs depending on the input information. On request,
this leads to a two channel shut-down. In the case of several input and output
pairs, each path is viewed as a separate safety function. The safety function of the
output is defined as the switching off of the power in the case of semiconductor
outputs or opening contacts in the case of relay outputs.
2. The second safety function is identical to that named under 1. with the one
difference that two two-channel safety inputs of a slave station are used here.
The further calculations of the PL/SIL apply to a two-channel safety fuction.
In the case of a one-channel input the requirements of PL b/c, Category 2 as per
ISO 13849-1 are only fulfilled if the safety function is marked by the change of the
input from ON to OFF. The minimum demand interval for a safety function of
PL b/c, Category 2 amounts to 55 hours. In the event of a safety function of PL b/c,
Category 2 being realised, a testing of the entire safety function including sensor
and actuator in accordance with ISO 13849-1 has to be ensured.
1.7 Performance Level
The Performance Level (in brief PL) to ISO 13849-1 describes the ability of safety-
orientated assemblies to perform a safety function under foreseeable conditions
(which must be included in the assessment) in order to achieve the expected risk
reduction. The PL is divided into 5 categories. This categorisation is made not with
numbers but with the letters a to e.
The simplest way to determine the PL required for an application is to assess the
risk based on a risk graph.

Overview
1
Instruction Manual PROTECT-PSC
V 2.6R01 / 04.19
1–8
1.7.1 Risk graph
Starting from the left, 3 criteria are used in a tree structure to determine the
required PL (PLrfor required Performance Level).
F
Fi ig gu ur re e 1 1- -2 2 R Ri is sk k g gr ra ap ph h t to o d de et te er rm mi in ne e t th he e r re eq qu ui ir re ed d P PL L
Warning:
Use the property F2for the criterion F if the intervention is made more than once
per shift.
1.7.2 Determining the Performance Level
In order to determine the PL for the entire system, the PL for each individual
element of the functional chain (sensor PROTECT-PSC actuator) must be
known. The PL of the entire system can then be determined from the individual
performance levels using the algorithms described below.
Performance Level of the PROTECT-PSC
The PROTECT-PSC Sicherheits-Kleinsteuerung on its own (without the sensory
system connected upstream and the actuator system connected downstream)
satisfies all requirements of Performance Level e, Category 4 to ISO 13849–1 with
two channelled input/output circuitry.

Overview
1
Instruction Manual PROTECT-PSC
V 2.6R01 / 04.19
1–9
Performance Level of the entire system
When determining the PL of the entire system a series connection of N elements
whose PL is already known is assumed.
F
Fi ig gu ur re e 1 1- -3 3 S Se er ri ie es s c co on nn ne ec ct ti io on n o of f s sa af fe et ty y r re el le ev va an nt t p pa ar rt ts s o of f a a c co on nt tr ro ol l s sy ys st te em m
Firstly, the element with the lowest PL in the entire system is determined. This PL
(PLlow) is a starting point for the further determination of the overall PL.
Afterwards, the number Nlow ≤ N of the elements is determined using PL=PLlow.
The PL of the entire system can then be determined using these two factors and
Table 1-1.
PLlow
Nlow
PL
a
> 3

none, not permit
≤ 3

a
b
> 2

a
≤ 2

b
c
> 2

b
≤ 2

c
d
> 3

c
≤ 3

d
e
> 3

d
≤ 3

e
T
Ta ab bl le e 1 1- -1 1 D De et te er rm mi in na at ti io on n o of f t th he e P PL L o of f a an n e en nt ti ir re e s sy ys st te em m. .
The values used for calculation are based on reliable values for the center of each
PL.
SRP/CS1
PL1
SRP/CS2
PL2
SRP/CS3
PL3
SRP/CS
PL
SRP/CS = Safety-Related Part of a Control System

Overview
1
Instruction Manual PROTECT-PSC
V 2.6R01 / 04.19
1–10
1.8 Safety Integrity Level
The Safety Integrity Level (SIL) to IEC 61508 is one of 4 levels to specify the
requirements of safety integrity of the safety functions which are assigned to all
elements of the chain. Level 4 is the highest and level 1 the lowest safety integrity
level.
The Safety Integrity Level is defined for the following operating modes:
low demand rate : whereby the rate of demand to the safety related system is no
more from once per year and is no greater than double the frequency of the repeat
check.
with high demand rate/continuous demand : whereby the rate of demand to the
safety related system is more than once per year or is greater than double the
frequency of the repeat check.
The average probability of a failure of a safety function with low demand rate is
specified by the PFD factor (average probability of failure to perform its design
function on demand).
The average probability of a failure with a function with high/continuous demand
rate is specified by the PFH factor (average probability of a dangerous failure per
hour).
The following is an overview of the PROTECT-PSC values.
Safety function : One two-channel safety input affects one dual channel
safety output
Demand rate
Failure probability
low
PFD = 3.0 * 10-4
high/continuous
PFH = 1.5 *10-8 /h
Safety function : Two two-channel safety inputs affect one dual channel
safety output
Demand rate
Failure probability
low
PFD = 3.4 * 10-4
high/continuous
PFH = 1.9 * 10-8 /h
Safety function : One single-channel safety inputs affect one dual-channnel
safety output
Demand rate
Failure probability
high/continuous
PFH = 2.5 * 10-7/h
Safety function: One single-channel safety inputs affect one single-channel
semiconductor safety output
Demand rate
Failure probability
high/continuous
PFH = 4.8 * 10-7/h
T
Ta ab bl le e 1 1- -2 2 O Ov ve er rv vi ie ew w o of f t th he e f fa ai il lu ur re e p pr ro ob ba ab bi il li it ti ie es s
The PROTECT-PSC is suitable for SIL 3 safety functions due to the restrictions of
the hardware’s safety integrity:
•SFF = 99.0%
•Hardware error tolerance = 1,
•Type B partial system
for SIL 3 safety functions suitably.

Overview
1
Instruction Manual PROTECT-PSC
V 2.6R01 / 04.19
1–11
Either by means of the process (application) or by means of organisational
measures, it must be ensured that the safety function is requested at least once
per year.
Every element of the chain must satisfy all requirements (e.g. restrictions of the
safety integrity of the hardware due to the architecture) of the resultant SIL
In order to determine the SIL, the PFH or PFD factors of the chain (sensor 
PROTECT-PSC actuator) must be added together depending on the operating
mode. The resultant SIL can be determined using the following tables.
PFDi
SIL
10-4 bis < 10-3
3
10-3 bis < 10-2
2
10-2 bis < 10-1
1
T
Ta ab bl le e 1 1- -3 3 O Op pe er ra at ti in ng g m mo od de e w wi it th h l lo ow w d de em ma an nd d r ra at te e
PFHi
SIL
10-8 bis < 10-7
3
10-7 bis < 10-6
2
10-6 bis < 10-5
1
T
Ta ab bl le e 1 1- -4 4 O Op pe er ra at ti in ng g m mo od de e w wi it th h h hi ig gh h d de em ma an nd d r ra at te e / / c co on nt ti in nu uo ou us s d de em ma an nd d

Overview
1
Instruction Manual PROTECT-PSC
V 2.6R01 / 04.19
1–12
1.9 Calculation example
F
Fi ig gu ur re e 1 1- -4 4 C Ca al lc cu ul la at ti io on n e ex xa am mp pl le e / / P Pe er rf fo or rm ma an nc ce e L Le ev ve el l / / S Sa af fe et ty y I In nt te eg gr ri it ty y L Le ev ve el l
1.9.1 Performance Level
The PL of the entire system is calculated as follows:
PLLow = c
NLow = 1
Result according to Table 1-1 : PL = c
1.9.2 SIL with high demand rate
The SIL of the entire system is calculated as follows:
PFH = PFHsensor + PFHPROTECT-PSC + PFHactuator
= 5.2 * 10-6 /h + 1.5 *10-8 /h + 2.6 * 10-8 /h
= 5.2 * 10-6 /h
Result according to Table 1-4 : SIL = 1
1.9.3 SIL with low demand rate
The SIL of the entire system is calculated as follows:
PFD = PFDsensor + PFDPROTECT-PSC + PFDactuator
= 4.1 * 10-3 + 3.0 * 10-4 + 1.9 * 10-4
= 4.6 * 10-3
Result according to Table 1-3 : SIL = 2
Sensor
PL : c
PFH : 5.2 * 10-6 /h
PFD : 4.1 * 10-3
PROTECT-PSC
PL : e
PFH : 1.5 * 10-8/h
PFD : 3.0 * 10-4
Actuator
PL : e
PFH : 2.6 * 10-8 /h
PFD : 1.9 * 10-4