ABB / AC500 / AC500-S safety

The channel count on AC500-S safety I/O halves when you need SIL 3 instead of SIL 2. A DI581-S is a 16 channel module and an 8 channel module, depending on the rating you are working to.

AC500-S is the safety PLC that runs alongside a standard AC500 station. The safety CPU sits next to the standard CPU on the same terminal base, so the two systems share a rack and a project.

The channel count depends on the SIL rating

The most important thing on this page, and the easiest way to under-order.

Same module, half the channels. The higher rating requires channels to be used in pairs, so a 16 channel input module gives you eight safety functions at PL e.

If you are counting channels off a datasheet without noting which rating the figure applies to, you will order half the modules you need. And if a system was designed at SIL 2 and someone later needs PL e on those circuits, the existing module capacity halves.

The DI581-S also carries 8 test pulse output channels, used to detect short circuits and cross faults in the field wiring.

The safety CPU needs a standard CPU alongside it

AC500-S is not a standalone safety PLC. ABB specifies that the safety CPU is mounted on the left side of the non-safety CPU, on the same terminal base.

Communication between the two runs through the internal communication bus integrated in the terminal base.

So a safety station needs:

The firmware requirement

The standard CPU must be running firmware V2.2.1 or later. ABB names PM573, PM583 and PM592 as examples, and states the requirement applies to others too.

This catches people adding safety to an existing AC500 station. If the installed PM CPU predates that firmware, it needs updating before the safety CPU will work with it.

Worth checking before the outage rather than during it. See our PM processor page for the CPU range.

SM560-S safety CPU

Certified up to SIL 3 to IEC 62061 and IEC 61508 edition 2, and PL e to ISO 13849.

ABB describes the safety CPU's function as processing safety input signals and internal data storage to generate signals to safety output modules.

Diagnostics come through LEDs and the onboard display of the standard CPU, which is another reason the two work as a pair.

The FD variants are different parts. If your installation has an SM560-S-FD-1 or FD-4, order that rather than the base SM560-S.

Safety I/O modules

Safety I/O modules are certified up to SIL 3 to IEC 62061 and IEC 61508 edition 2.

DX581-S is the only one with outputs

Worth noting when planning. The DI581-S and AI581-S are input only. If a safety function needs to drive a contactor or valve, that is a DX581-S.

One terminal unit, three modules, one risk

ABB states that the same TU582-S is used by all AC500-S safety I/O modules. It is a spring-type terminal unit.

That is convenient and it creates a hazard worth understanding. ABB addresses it directly: if a TU582-S has been wired for a DX581-S with safety digital outputs, and a DI581-S or AI581-S is placed on that terminal unit instead, the design ensures the safety digital output clamps cannot become energised.

The practical point is that all three modules physically fit the same wired terminal unit. During a module swap it is possible to fit the wrong one, and the terminal unit will accept it.

ABB also warns to make sure safety I/O modules are properly attached to the TU582-S with good electrical contact, since a poor connection can produce an unintended system state with misleading LED indications.

If you are diagnosing odd LED behaviour on a safety module, reseating it on the terminal unit is worth doing before anything else.

No hot swap. At all.

ABB is unambiguous, and this is a danger notice rather than a caution.

Hot plug and hot swap of energised modules is not permitted. All power sources, both supply and process voltages, must be switched off while working on any AC500 system, including safety modules.

Plenty of modular I/O systems allow live module replacement. AC500 does not. If your maintenance procedure assumes a hot swap, it is wrong for this platform.

The modules do not hold their own configuration

ABB states that the DX581-S does not store configuration data itself. The configuration comes from the safety project.

So a replacement safety I/O module arrives blank and takes its configuration from the safety CPU on startup. That is good for spares holding: the module is not tied to a specific position by stored data.

But it means the safety project is the thing you cannot buy. Without it, a replacement safety CPU will not run the machine.

If you run AC500-S, confirm today that the safety project is backed up and that someone knows where it is. Recreating a certified safety application under outage pressure is not a maintenance task.

De-energise to trip

ABB specifies that the AC500-S safety PLC can be used as a de-energise to trip, normally energised system.

In a channel fault, the safe value of de-energised or zero is transferred to the safety logic module along with fault information.

That is the conventional arrangement for machine safety: loss of power means the safe state, so a broken wire trips the machine rather than disabling the protection.

PROFIsafe and restart behaviour

AC500-S uses PROFINET IO with the PROFIsafe profile for safe data transmission.

An important design note from ABB on start-up behaviour:

If your process does not allow automatic start-up after a power cycle, you must program restart protection in the safety program. Safety process data outputs must be blocked until manually acknowledged, and must not be enabled until it is safe to do so and faults have been corrected.

That is a programming requirement, not a hardware setting. It does not come by default, and it is the difference between a machine that restarts by itself after a power dip and one that waits for a person.

Temperature and safety calculations

A detail that matters if you are doing the PFH or PFD maths.

ABB defines the average temperature as plus 40 degrees C for safety value calculation, for both the normal range of 0 to plus 60 degrees C and the extended range of minus 40 to plus 70 degrees C on the XC version.

You must ensure the actual average operating temperature does not exceed that assumption, or the calculated safety values no longer hold.

ABB also notes that for calculating PFH and PFD values of a safety system, 15 percent is normally allocated to the PLC portion of the loop.

XC versions

AC500-S is available as AC500-S-XC for extreme conditions, covering minus 40 to plus 70 degrees C.

As with the rest of the AC500 range, the XC version carries no distinguishing marking. A part number beginning 1SAP3 identifies it. See the AC500 page.

On a safety system that matters twice over, because the temperature range feeds directly into the safety calculation above.

Accessories

Software

The safety application is developed in ABB's safety programming environment, historically CoDeSys Safety and now within Automation Builder. The standard application goes to the PM5xx CPU and the safety application to the SM560-S.

Two applications, two CPUs, one project. A replacement of either CPU needs the corresponding application.

Important: safety replacements

Safety components are certified as part of a machine's safety function, with a rated SIL or Performance Level.

A like-for-like replacement of the same order code preserves that assessment. A substitution may not. A module with a different channel arrangement, a standard version in place of an XC one, or an SM560-S in place of an FD variant can change the achieved rating even where the machine appears to run normally.

We will supply the exact order code you specify. If you ask us to suggest an alternative we will tell you what we think is equivalent and what differs, but the decision on whether a substitution is valid for your safety function belongs to whoever is responsible for the machine's safety assessment. We are a parts supplier, not your safety engineer.

What we can supply

Current production. SM560-S safety CPUs including FD variants, DI581-S, DX581-S and AI581-S safety I/O, TU582-S terminal units and accessories, in standard and XC versions. Quoted with a delivered lead time.

Surplus and tested used. Where lead times on new safety hardware are long, we can often find the same module sooner.

We buy AC500-S

Safety modules hold value. If you are decommissioning a machine, do not scrap them. See Sell To Us.

Related

ABB overview. AC500 controllers and S500 I/O and PM processor modules.

For safety controllers from other brands see Pilz PNOZmulti, Omron NX-SL and Allen-Bradley Guardmaster.

Send us your order codes

Tell us the SIL or PL you are working to, because that decides how many channels a module gives you. Check the order number for 1SAP3 if the installation is in an extreme environment. Quotes in NZD including GST.

Request a quote

Industech is an independent supplier of new, surplus and used industrial automation equipment. We are not an authorised distributor of, approved by, sanctioned by, or affiliated with ABB Ltd. ABB, AC500 and Automation Builder are trademarks of ABB Ltd. PROFIsafe and PROFINET are trademarks of PROFIBUS Nutzerorganisation. All trademarks, brand names and order codes are the property of their respective owners and are used here for identification purposes only. Information on this page is for identification and does not constitute a safety assessment.