Soliphant M with electronic insert FEM57 + Nivotester FTL325P

Transcription

1 T T Functional safety manual Soliphant M with electronic insert FEM57 + Nivotester FTL325P Level Limit Measuring System [Ex ia] FTL325P [Ex ia] FTL325P CH2 CH3 CH2 CH3 Application Overfill protection or operating maximum detection of all types of solids in tanks to satisfy particular safety systems requirements to IEC The measuring device fulfils the requirements concerning For safety functions up to SIL 2 Explosion protection by intrinsic safety EMC to EN and NAMUR Recommendation NE 21. Your benefits For overfill protection up to SIL 2 Independently assessed (Functional Assessment) by exida to IEC Permanent self-monitoring No calibration Protected against outside vibration Easy commissioning Space-saving switching unit Measuring system test by pressing a test-button Fail-safe by PFM technologie SD207F/00/en

2 Table of contents SIL declaration of conformity Functional Assessment Report Introduction Structure of the measuring system with Soliphant M with FEM57 + Nivotester FTL325P Level limit measuring system Safety function Supplementary device documentation Settings and installation instructions Installation instructions Settings for Soliphant M with FEM Settings for Nivotester FTL325P-#3#3 (3 channel) Response in operation and failure Failure rates of electrical components Repair Recurrent function tests of the measuring system Appendix Specific values and wiring options FMEDA Report Endress + Hauser

3 SIL declaration of conformity Example SIL05006b-en Endress + Hauser 3

4 Functional Assessment Report L00-FEM5xxxx xx-en Endress + Hauser

5 Introduction! Note! For general information about SIL please refer to: and in the Competence Brochure CP002Z "Safety in the Process Industry reducing risks with SIL" Structure of the measuring system with Soliphant M with FEM57 + Nivotester FTL325P Level limit measuring system The measuring system is displayed in the following diagram (example). Soliphant M [Ex ia] T [Ex ia] Electronic insert FTL325P T CH2 CH3 FTL325P CH2 CH3 Nivotester FTL325P (1 and 3 channel) L00-FTM5xxxx xx-en-002 Safety function The safety function applies to all settings in MAX safety (monitoring of the covered state) and use of the NO contacts of the level relays. The MAX safety setting has the effect that the level relay always works in quiescent current safety; i.e. the relay contact opens when: the switch point is exceeded (level exceeds response height) a fault occurs mains voltage fails In addition to the level relay, the alarm relay works in operating current safety and closes the contact, when: one of the following faults occurs: the sensor connection is interrupted the sensor connection short circuits the sensor identifies corrosion at the vibration system mains voltage fails The measuring range of Soliphant M depends on the medium, mounting location and fork length. The detection range is within the length of the fork and depends on the weight of the medium and the resulting type of fork: Standard fork with a length of 155 mm (Density of medium 10 g/l) and Short fork with a length of 100 mm (Density of medium 50 g/l) Endress + Hauser 5

6 The following settings are permitted for the safety function: Instrument Settings for the safety function As-delivered state Soliphant Self-test "OFF" Self-test "ON" Reduction of the PFDavg value Density switch setting: low bulk density/density setting Self-test "OFF" Density switch setting: high bulk density/density setting Diagnosis "ON" Diagnosis "OFF" Nivotester FTL325P-#3#3 Nivotester FTL325P-#1#1 MAX safety MAX safety All settings except " S function" (see chapter "Settings and installation intructions" 3 channel operation MAX safety MAX safety 1 channel operation 1 channel operation! Note!! Note! When the alarm relay releases, the level relay also releases. The alarm relay is not part of the safety function!! Note!! Note!! Note! Permitted versions of the Nivotester with Soliphant M with FEM57 for the safety function The following combinations are permitted for the measuring system: Nivotester FTL325P-H### Nivotester FTL325P-P### Nivotester FTL325P-T### Nivotester Valid HW version (hardware): V01.00 or higher; valid from serial number Soliphant FTM50-#####7###R# or FTM50-#####7###S# Soliphant FTM51-#####7###R# or FTM51-#####7###S# Soliphant FTM52-#####7###R# or FTM52-#####7###S# 2Cxxxxxxxxx Soliphant Z Valid FW version (firmware): V or higher Valid HW version (hardware): V01.00 or higher Permitted instrument types (# = all instrument versions permitted excepting 9 and Y) Month: December Safety function data The mandatory settings and data for the safety function can be found in the Appendix (Page 11). The shortest reaction time (switching delay) has to be set. MTTR is set at 8 hours under the condition that the electronics insert is on stock. Safety systems without a self-locking function must be monitored or set to an otherwise safe state after carrying out the safety function within MTTR. 1 2 C 0 1 January February.... December Year : Endress + Hauser

7 Supplementary device documentation The following must be available for the measuring system: Technical Information Operating Instructions Nivotester Soliphant M Relevant contents FTL325P TI350F/00 FTM50, FTM51, FTM52 TI392F/00 Connection data, Installation instructions 1 channel device FTL325P-#1#1 KA167F/00 3 channel device FTL325P-#3#3 KA168F/00 FTM50, FTM51 KA229F/00 FTM52 KA230F/00 Setting, configuration, remarks, function tests Settings and installation instructions Installation instructions The ambient conditions for the Nivotester FTL325P must correspond to IP54 (as per EN 60529). Please refer to the Compact Instructions (KA) for information regarding the correct installation of Soliphant M with FEM57. Since the application conditions have an effect on the safety of the measurement, pay attention to the notes in the Technical Information (TI) and Compact Instructions (KA). Refer to the following documentation for instructions on setting the instruments: Setting description in documentation Nivotester 1 channel device FTL325P-#1#1 KA167F/00 3 channel device FTL325P-#3#3 KA168F/00 Soliphant M FTM50, FTM51 KA229F/00 FTM52 KA230F/00 Settings for Soliphant M with FEM57 The density switch setting has an influence on probability of failure and function test type (see Chapter "Appendix"). The test mode setting has influence on the function test (see Chapter "Recurrent function tests of the measuring system"). Switch setting for the safety function: OFF ON OFF ON OFF ON OFF ON or L00-FTM5xxxx xx-xx-016 L00-FTM5xxxx xx-xx-017 One switch for selt-test OFF Self-test switched OFF ON At the same time, switching delay 0.5 s when covered, density setting low bulk density and diagnosis ON: Perform self-test when voltage returns. The PFDavg values reduced by the self-test are displayed in the "Appendix" Endress + Hauser 7

8 One switch for switching delay 0.5 s when covered, 1.5 s when uncovered (short fork 1 s) 5 s when covered, 5 s when uncovered One switch for bulk density/density setting 50 g/l standard fork, 200 g/l short fork (high bulk density) 10 g/l standard fork, 50 g/l short fork (low bulk density) One switch for diagnosis OFF Diagnosis of abrasion and build-up switched OFF. ON Diagnosis of abrasion and build-up switched ON. For additional density setting to high bulk density: abrasion and build-up are indicated per LED at the electronic insert only For additional density setting to low bulk density: output of "signal on alarm" for abrasion and build-up! Note! Settings for Nivotester FTL325P-#3#3 (3 channel) " Caution! The SIL evaluation for the Soliphant M comprises the complete device, including the Nivotester, the electronics insert, the tuning fork with piezo drive, the process connection and the internal wiring. In applications with extremely strong external vibrations > 0.05 g 2 /Hz and light weight bulk solids < 600 gr/l a functional test is recommended! Changes to the settings at the electronic insert FEM57 after measuring system start-up can impair the safety function! It is recommended to leave the switching elements following the overfill protection in the safe state until the alarm signal has been acknowledged. CH2 CH3 S Channels 2+3 in S function " Caution! This setting is not permitted for the safety function! CH2 CH3 S Channel 1 independent, Channels 2+3 in S function " Caution! Channel 1 is permitted for the safety function! Channels 2 and 3 in this settings are not permitted for the safety function! 8 Endress + Hauser

9 " Caution! Observe the following for the Nivotester FTL325P: The operator must use suitable measures (e.g. current limiter, fuses) to ensure the relay contact characteristics are not exceeded: U 253 V AC 50/60 Hz, I 2 A, P 500 VA at cos ϕ 0.7 or U 40 V DC, I 2 A, P 80 W " Caution! Changes to the measuring system and settings after start-up can impair the protection function! Response in operation and failure The response in operation and failure is described in the following documentation: Setting description in documentation Nivotester 1 channel device FTL325P-#1#1 KA167F/00 3 channel device FTL325P-#3#3 KA168F/00 Soliphant M FTM50, FTM51 KA229F/00 FTM52 KA230F/00 Failure rates of electrical components The underlying failure rates of electrical components are specified for the useful lifetime according to IEC Section Note 3. Repair If a SIL-marked device that has been operated in a functional safety application fails, the "Declaration of Hazardous Material and De-Contamination" form containing the appropriate information "Used as a SIL device in a Safety Instrumented System" must be enclosed with the defective device when it is returned. Endress + Hauser 9

10 Recurrent function tests of the measuring system " Caution! The operativeness of the overfill protection must be checked periodicaly if the PFD avg values given in the Appendix are used. The check must be carried out in such a way that it is proven that the overfill protection functions perfectly in interaction with all components. This is guaranteed when the response height is approached in a filling process. If it is not practical to fill to the response height, suitable simulation of the level or of the physical measuring effect must be used to make the level sensor respond. If the operativeness of the level sensor/transmitter can be determined otherwise (exclusion of faults that impair function), the check can also be completed by simulating the corresponding output signal. Note the following points for the function test: Test each channel individually by pressing the associated test key. Check the electrical switching of relay contacts, e.g. using a hand multimeter connected to the terminals. In multi-channel devices, all channels which do not carry out a safety function must be included in the recurrent function tests if faulty functioning cannnot be detected by any other means - e.g. by means of independent protective measures or changing the response of the measuring point. A positive test result is optained when the system reaction corresponds to the description. If the system reaction does not correspond to the described procedure, the monitored process must be kept in a safe state by additional or different measures until the safety system is repaired. 10 Endress + Hauser

11 Appendix Specific values and wiring options Specific values and wiring options for the measuring system Soliphant M with FEM57 and Nivotester FTL325P. The tables show values and wiring options relevant to safety for the measuring system. 1oo1D architecture [CONF 1] Soliphant M with FEM57 SIL SIL 2 HFT 0 SFF 96 % PFD avg (low demand mode of operation) λ sd 2 λ su λ dd λ du MTBF x FIT 432 FIT 39 FIT 23 FIT 157 years Wiring scheme PFM L00-FTM5xxxx xx-xx-010 Function test with test key Complete function test e.g. by approaching level annual not required within normal life time 1oo1D structure 0,180x10 2 0,160x10 2 0,140x10 2 Probability 0,120x10 2 0,100x10 2 0,080x10 2 0,060x10 2 PFDavg 0,040x10 2 0,020x10 2 0,000x Test interval [years] L00-FTM5xxxx xx-en-005 Endress + Hauser 11

12 1oo1D architecture [CONF 2] Nivotester FTL325P-#1#1 Settings MAX L00-FEM5xxxx xx-002 SIL SIL 2 HFT 0 SFF 97 % PFD avg (low demand mode of operation) λ sd 2 λ su λ dd λ du MTBF x FIT 774 FIT 39 FIT 33 FIT 101 years Wiring scheme L00-FTM5xxxx xx-xx-004 : Function test with test key Complete function test e.g. by approaching level annual not required within normal life time 1oo1D structure 0,180x10 2 0,160x10 2 0,140x10 2 *1 Probability 0,120x10 2 0,100x10 2 0,080x10 2 0,060x10 2 *2 PFDavg 0,040x10 2 0,020x10 2 0,000x Test interval [years] *1 without self-test *2 with self-test (annual) L00-FTM5xxxx xx-en Endress + Hauser

13 1oo1D architecture [CONF 3] Nivotester FTL325P-#3#3 Settings MAX L00-FEM5xxxx xx-002 SIL SIL 2 HFT 0 SFF 97 % PFD avg (low demand mode of operation) λ sd 2 λ su λ dd λ du MTBF x FIT 827 FIT 39 FIT 38 FIT 94 years Wiring scheme CH2 CH3 L00-FTM5xxxx xx-xx-006 CH2 or CH3: Function test with test key Complete function test e.g. by approaching level annual not required within normal life time 1oo1D structure 0,180x10 2 0,160x10 2 *1 0,140x10 2 Probability 0,120x10 2 0,100x10 2 0,080x10 2 0,060x10 2 *2 PFDavg 0,040x10 2 0,020x10 2 0,000x Test interval [years] *1 without self-test *2 with self-test (annual) L00-FTM5xxxx xx-en-007 Endress + Hauser 13

14 1oo2D architecture [CONF 4] Nivotester FTL325P-#3#3 Settings MAX L00-FEM5xxxx xx-003 SIL SIL 2 HFT 1 SFF 97 % PFD avg (low demand mode of operation) λ sd 2 λ su λ dd λ du MTBF x FIT 827 FIT 39 FIT 38 FIT 94 years Wiring scheme CH2 CH3 SPS 1oo2 L00-FTM5xxxx xx-xx-014 Function test with test key Complete function test e.g. by approaching level annual not required within normal life time 1oo2D structure 0,180x10 2 0,160x10 2 0,140x10 2 Probability 0,120x10 2 0,100x10 2 0,080x10 2 0,060x10 2 PFDavg 0,040x10 2 0,020x10 2 0,000x Test interval [years] L00-FTM5xxxx xx-en Endress + Hauser

15 2oo3D architecture [CONF 5] Nivotester FTL325P-#3#3 Settings MAX L00-FEM5xxxx xx-004 SIL SIL 2 HFT 1 SFF 96 % PFD avg (low demand mode of operation) λ sd 2 λ su λ dd λ du MTBF x FIT 854 FIT 39 FIT 50 FIT 91 years Wiring scheme CH2 CH3 SPS 2oo3 L00-FTM5xxxx xx-xx-013 Function test with test key Complete function test e.g. by approaching level annual not required within normal life time 2oo3D structure 0,180x10 2 0,160x10 2 0,140x10 2 Probability 0,120x10 2 0,100x10 2 0,080x10 2 0,060x10 2 PFDavg 0,040x10 2 0,020x10 2 0,000x Test interval [years] L00-FTM5xxxx xx-en-009 Endress + Hauser 15

16 1oo1D architecture [CONF 6] Nivotester FTL325P-#3#3 Settings CH2 MAX ( S: not for safety function) CH3 S L00-FEM5xxxx xx-005 SIL SIL 2 HFT 0 SFF 97 % PFD avg (low demand mode of operation) λ sd 2 λ su λ dd λ du MTBF Wiring scheme x FIT 774 FIT 39 FIT 33 FIT 101 years SIL CH2 CH3 L00-FTM5xxxx xx-xx-009 : Function test with test key Complete function test e.g. by approaching level annual not required within normal life time 1oo1D structure 0,180x10 2 0,160x10 2 0,140x10 2 *1 Probability 0,120x10 2 0,100x10 2 0,080x10 2 0,060x10 2 *2 PFDavg 0,040x10 2 0,020x10 2 0,000x Test interval [years] *1 without self-test *2 with self-test (annual) L00-FTM5xxxx xx-en Endress + Hauser

17 FMEDA Report Management summary This report summarizes the results of the hardware assessment carried out on the level limit switch Soliphant M with PFM output FEM57 and software version V and Nivotester FTL325P for applications with MAX detection. Table 1 gives an overview of the different configurations which have been assessed. The hardware assessment consists of a Failure Modes, Effects and Diagnostics Analysis (FMEDA). A FMEDA is one of the steps taken to achieve functional safety assessment of a device per IEC From the FMEDA, failure rates are determined and consequently the Safe Failure Fraction (SFF) is calculated for the device. For full assessment purposes all requirements of IEC must be considered. Table 1: Configuration overview [CONF 1] FEM57 Configurations [CONF 2] FEM57 with Nivotester FTL325P as single channel device in single channel mode [CONF 3] FEM57 with Nivotester FTL325P as three channel device in single channel mode with two output relays in parallel [CONF 4] FEM57 with Nivotester FTL325P as three channel device in dual channel mode with one channel having two output relays in parallel [CONF 5] FEM57 with Nivotester FTL325P as three channel device in three channel mode [CONF 6] FEM57 with Nivotester FTL325P as three channel device in single channel mode The failure rates used in this analysis are the basic failure rates from the Siemens standard SN According to table 2 of IEC the average PFD for systems operating in low demand mode has to be 10-3 to < 10-2 for SIL 2 safety functions. A generally accepted distribution of PFDAVG values of a SIF over the sensor part, logic solver part, and final element part assumes that 35% of the total SIF PFDAVG value is caused by the sensor part. For a SIL 2 application the total PFDAVG value of the SIF should be smaller than 1,00E-02, hence the maximum allowable PFDAVG value for the sensor part would then be 3,50E-03. exida.com GmbH e+h r033 v1 r1.0.doc, July 5, 2005 Stephan Aschenbrenner Page 2 of 4 L00-FEM57xxx xx-en-002 Failure Modes, Effects and Diagnostic Analysis Project: Level limit switch Soliphant M with PFM output FEM 57 and Nivotester FTL325P Applications with level limit detection in solids (MAX detection) Customer: Endress+Hauser GmbH+Co. KG Maulburg Germany Contract No.: E+H 03/03-22 Report No.: E+H 03/03-22 R033 Version V1, Revision R1.0, July 2005 Stephan Aschenbrenner The document was prepared using best effort. The authors make no warranty of any kind and shall not be liable in any event for incidental or consequential damages in connection with the application of the document. All rights on the format of this technical report reserved. The level limit switch Soliphant M with PFM output FEM57 is considered to be a Type B 1 component with a hardware fault tolerance of 0. For Type B components with a hardware fault tolerance of 0 the SFF shall be > 90% according to table 3 of IEC for SIL 2 (sub-) systems. Endress+Hauser together with exida.com performed a qualitative analysis of the mechanical parts of the level limit switch Soliphant M with PFM output FEM57. This analysis was used by exida to calculate the failure rates of the sensor element using different failure rate databases ([N5], [N6], [N7] and exida s experienced-based data compilation) for the different components of the sensor element (see [R1]). The results of the quantitative analysis were used for the calculations described in section 5.2 to Type B component: Complex component (using micro controllers or programmable logic); for details see of IEC L00-FEM57xxx xx-en-001 Endress + Hauser 17

18 L00-FEM57xxx xx-en-004 Table 2 [CONF 1] Failure rates according to IEC sd su 2 dd du SFF DCS 3 DCD FIT 432 FIT 39 FIT 23 FIT 96% 26% 62% Table 3: [CONF 1] PFDAVG values T[Proof] = 1 year T[Proof] = 5 years T[Proof] = 10 years PFDAVG = 9,96E-05 PFDAVG = 4,98E-04 PFDAVG = 9,96E-04 Table 4 [CONF 2] / [CONF 6] Failure rates according to IEC sd su 2 dd du SFF DCS 3 DCD FIT 774 FIT 39 FIT 33 FIT 96% 18% 54% Table 5: [CONF 2] / [CONF 6] PFDAVG values T[Proof] = 1 year T[Proof] = 5 years T[Proof] = 10 years PFDAVG = 1,43E-04 PFDAVG = 7,13E-04 PFDAVG = 1,42E-03 Table 6 [CONF 3] Failure rates according to IEC sd su 2 dd du SFF DCS 3 DCD FIT 827 FIT 39 FIT 38 FIT 96% 17% 50% Table 7: [CONF 3] PFDAVG values T[Proof] = 1 year T[Proof] = 5 years T[Proof] = 10 years PFDAVG = 1,65E-04 PFDAVG = 8,24E-04 PFDAVG = 1,65E-03 Table 8 [CONF 4] Failure rates according to IEC sd su 2 dd du SFF DCS 3 DCD FIT 827 FIT 39 FIT 38 FIT 96% 17% 50% Table 9: [CONF 4] PFDAVG values T[Proof] = 1 year T[Proof] = 5 years T[Proof] = 10 years PFDAVG = 8,29E-06 PFDAVG = 4,21E-05 PFDAVG = 8,58E-05 Table 10 [CONF 5] Failure rates according to IEC sd su 2 dd du SFF DCS 3 DCD FIT 854 FIT 39 FIT 50 FIT 95% 16% 43% Table 11: [CONF 5] PFDAVG values T[Proof] = 1 year T[Proof] = 5 years T[Proof] = 10 years PFDAVG = 1,12E-05 PFDAVG = 5,98E-05 PFDAVG = 1,29E-04 2 Note that the SU category includes failures that do not cause a spurious trip 3 DC means the diagnostic coverage (safe or dangerous). exida.com GmbH e+h r033 v1 r1.0.doc, July 5, 2005 Stephan Aschenbrenner Page 3 of 4 The boxes marked in green ( ) mean that the calculated PFDAVG values are within the allowed range for SIL 2 according to table 2 of IEC and table 3.1 of ANSI/ISA and do fulfill the requirement to not claim more than 35% of this range, i.e. to be better than or equal to 3,50E-03. Because the Safe Failure Fraction (SFF) is above 90% for all considered versions, also the architectural constraints requirements of table 3 of IEC for Type B subsystems with a Hardware Fault Tolerance (HFT) of 0 are fulfilled. The failure rates listed above do not include failures resulting from incorrect use of the level limit switch Soliphant M with PFM output FEM57, in particular humidity entering through incompletely closed housings or inadequate cable feeding through the inlets. The listed failure rates are valid for operating stress conditions typical of an industrial field environment similar to IEC class C (sheltered location) with an average temperature over a long period of time of 40ºC. For a higher average temperature of 60 C, the failure rates should be multiplied with an experience based factor of 2,5. A similar multiplier should be used if frequent temperature fluctuation must be assumed. A user of the level limit switch Soliphant M with PFM output FEM57 can utilize these failure rates in a probabilistic model of a safety instrumented function (SIF) to determine suitability in part for safety instrumented system (SIS) usage in a particular safety integrity level (SIL). A full table of failure rates is presented in section 5.2 to 5.6 along with all assumptions. It is important to realize that the no effect failures and the annunciation failures are included in the safe undetected failure category according to IEC Note that these failures on its own will not affect system reliability or safety, and should not be included in spurious trip calculations. The failure rates are valid for the useful life of the level limit switch Soliphant M with PFM output FEM57, which is estimated to be between 8 and 12 years (see Appendix 3). exida.com GmbH e+h r033 v1 r1.0.doc, July 5, 2005 Stephan Aschenbrenner Page 4 of 4 L00-FEM57xxx xx-en Endress + Hauser

19 Endress + Hauser 19

20 International Head Quarter Endress+Hauser GmbH+Co. KG Instruments International Colmarer Str Weil am Rhein Deutschland Tel Fax info@ii.endress.com SD207F/00/en/ FM+SGML 6.0 ProMoDo