LABEL. Invest in Confidence. SIL Actuators

Transcription

1 LABEL Invest in Confidence SIL Actuators

2

3 More than safety commands SIL certified signaling functions WITH BERNARD CONTROLS, ACHIEVE A NEW STEP FORWARD IN THE SECURITY OF YOUR PROCESSES: - SIL2 (SIL3 IN 1OO2) CERTIFIED ESD FUNCTIONS - SIL2 CERTIFIED SIGNALING FUNCTIONS The BC Premium label is the guarantee of high performance, reliable and innovative actuation solutions designed to sustain severe environmental and operational conditions. Decades of return of experience from very demanding applications such as nuclear qualified valves actuation have shaped our technical orientations and our commitment to quality and safety. Moreover, BC Premium labeled products offer user-friendliness and extremely low level of maintenance requirements. In the spirit of the BC PREMIUM label, taking into account market demands for increased functional safety, BERNARD CONTROLS designs and produces SIL certified actuators. Contents All you have to know about SIL > 4 SIL by BERNARD CONTROLS > 8 BERNARD CONTROLS actuators with SIL > 10 SIL Certified functions > 11 INTELLI+ SIL layout > 12 Technical specifications > 14

4 All you have to know about SIL Functional safety Industrial installations, whether chemical, petrochemical or any others, have been subject to continuously toughening performance and security requirements in the past decades. These requirements coupled with industrial accidents have brought increased attention to the securing of industrial processes and to the concept of functional safety. In the 1990 s, producers and end users of electronical equipments moved toward the setting of some standards that would help to control risks. This movement led to the IEC and, later, IEC standards which introduce the concept of SIL - Safety Integrity Level - as a measure of the level of security provided by a technical measurement of a risk control system. These standards make us not only consider the possibility of a failure as real but also evaluate the probability of fault of the system and secure the ability to detect any fault as soon as it appears. In other words, it implies to implement safety functions to reduce the risk and consequences of a failure. The IEC standard defines a methodology to measure and reduce the risk on safety-related systems (SIS) or subsystems (SIF), while granting a SIL value (1 to 4) to SIS. This standard is mainly written to focus on E/E/PE (Electric/Electronic/ Programmable Electronic) devices. Level of confidence According to IEC 61508, the level of confidence is measured in PFD* or PFH*. This is a probability calculation based on a global evaluation (FMEDA) of safety function(s). Based on the PFD value, it s possible to define a Safety Integrity Level (SIL) between 1 & 4. Low demand mode PFDavg Probability of Failure on Demand High demand mode or continuous mode PFH Probability of dangerous Failure per Hour SIL Safety Integrity Level RRF Risk Reduction Factor (RRF = 1/PFD) 10-1 to to to to to to to to to to to to Please note that the SIL assessment is always linked to a safety related function of a device, not to a product itself. For example, an electrical actuator can propose an ESD function with SIL assessment, but the other functions of the actuator are not necessarily SIL complying. 4 *See Lexicon page 7

5 LABEL Safety Instrumented System - SIS A safety function is always included in a command chain using Sensors (measures), PLC (treatment and commands), Safety device (operating components). The IEC standard details how to develop a Safety Instrumented System with SIL assessment. The Safety Instrumented System (SIS) is made up of several Safety Intrumented Functions (SIF). Each SIF has its own SIL level. The combination of all these levels determines the SIL capability of the whole system. More specifically, it s possible to use redundancies to improve the SIL. Example of SIS, driving to ESD command: DCS Process Commands Signaling PLC Safety ESD command SIF 4 SIF 1 SIF 2 SIF 3 SIF x SAFETY INSTRUMENTED SYSTEM Main characteristic values FMEDA drives to identify 4 kinds of possible failures on each SIF. A rate is calculated accordingly: λsd Total failure rate for safe detected failures λsu Total failure rate for safe undetected failures λdd Total failure rate for dangerous detected failures λdu Total failure rate for dangerous undetected failures SIL Actuators 5

6 The SFF (Safe Failure Fraction) is the probability of the system failing in a safe state. It is a percentage calculated as follow: SFF = (All failures minus dangerous undetected) / All failures According to the level of complexity, the expectations of the standard are not the same. Type A concerns simple subsystem (E/E), Type B concerns complex subsystem with Programmable electronics such as BERNARD CONTROLS INTELLI+. The SFF may take into account a Hardware Fault Tolerance (HFT): HFT = x means, that x+1 faults could cause a loss of the safety function. Safe Failure Fraction (SFF) Hardware Fault Tolerance (Type A simple subsystem) Hardware Fault Tolerance (Type B complex subsystem) <60% SIL1 SIL2 SIL3 Not SIL SIL1 SIL2 60 to 90% SIL2 SIL3 SIL4 SIL1 SIL2 SIL3 90 to 99% SIL3 SIL4 SIL4 SIL2 SIL3 SIL4 >99% SIL3 SIL4 SIL4 SIL3 SIL4 SIL4 Redundancy In practical terms, the PFD (or PFH) of a Safety Instrumented System is the addition of the PFD (or PFH) of each Safety Instrumented Function. Example: PFD(SIS) = PFD(Sensor) + PFD(PLC) + PFD(Actuator) The PFD of the SIS is higher than the PFD of each SIF included in the SIS. This can drive to a safety integrity level lower than the one expected. According to IEC61508, it is possible to increase the safety integrity level by using redundant configurations. In one out of two (1oo2) configuration, it is possible to propose and certify a SIL3 level using a combination of two redundant SIL2 functions. 1oo2 configuration for SIL3 assessment with ESD Close 1oo2 configuration for SIL3 assessment with ESD Open 6

7 LABEL Lexicon ESD Emergency Shut Down (driving to 3 possibility: ESD Close, ESD Open, ESD Stayput) FMEDA (Failure Modes, Effects and Diagnostic Analysis) Methodology to identify and evaluate the effects of different component failure modes, to determine what could eliminate or reduce the chance of failure, and to document a system in consideration. HFT High demand mode Low demand mode MTBF Hardware Fault Tolerance is the number of fault accepted by the subsystem without losing its SIL assessment. (or continuous mode) Frequency of demands on a safety-related system greater than one per year or greater than twice the proof-test frequency. Frequency of demands on a safety-related system lower than once a year and lower than twice the proof-test frequency. Mean Time Between Failure. MTBF is a probability of the mean time between failures. This value is generally used as MTTF (Mean Time To - first - Failure) MTTR Mean Time To Repair (BC value = 8h) PFD or PFD avg PFH Proof test interval RRF SFF SIF SIL SIS TYPE A TYPE B 1oo2 (1 out of 2) Average probability of failure on demand (Applicable on low demand mode less than once a year). The PFD increase constantly. Probability of dangerous failure per hour (Applicable on High demand mode or continuous mode). Interval between periodic tests performed to detect failures in a safety-related system. This allows decreasing the PFD average. Risk Reduction Factor is equal to 1/PFD. Safe Failure Fraction is the probability of the system failing in a safe state. SFF = ( All failures minus dangerous undetected ) / All failures. Safety instrumented function is a subsystem of safety function. The SIF has its own level of confidence. Safety Integrity Level applicable to a system or a subsystem. The higher the value, the higher the level of confidence. Safety instrumented system including one or several SIF. Refer to non-programmable Electronic in general (simple subsystem). Refer to programmable Electronic in general (complex subsystem). Redundant configuration of a safety function, this may increase the SIL value by putting in series or in parallel two safety functions. SIL Actuators 7

8 SIL by BERNARD CONTROLS Increased security for your processes Strongly committed to address customers most demanding requirements, BERNARD CONTROLS offers weatherproof & explosionproof quarter-turn and multiturn actuators with SIL. These actuators have been specially designed with SIL in mind since BERNARD CONTROLS has created a fully dedicated electronics for these INTELLI+ actuators. SIL certification on ESD functions Thanks to its fully dedicated control board, BERNARD CONTROLS propose a SIL2 assessment on the following safety instrumented functions: ESD Open ESD Close ESD Stayput When the customer wants to increase even more the safety integrity level by using a redundant configuration (1oo2), BERNARD CONTROLS also proposes SIL3 assessment on the following functions: ESD Open ESD Close SIL certification on signaling functions If sensors leading to an emergency shut-down (flow, pressure, smoke...) are subject to the requirements of SIL assessment, the signaling of the actuator also proves to be a key element of the Safety Instrumented System. Indeed, in case of emergency, ensuring the good functioning of safety commands is not enough: the accuracy of signaling data is essential to make the good decision and activate the ESD functions. Relying on many years of customers feedback, BERNARD CONTROLS has included this key criterion in its SIL specifications and offer SIL2 assessment on the following signaling functions: Valve opened Valve closed 4/20mA position signal (optional function) DCS Process Commands Signaling PLC Safety SIL SIGNALING ESD command SIF 4 SIF 1 SIF 2 SIF 3 SIF X SIS WITH SIL ASSESSMENT 8

9 LABEL Moreover, if the accuracy of signaling functions is crucial to make the good decision, their availability is even more important at first. Thanks to the 24VDC back-up supply available on BC actuators, signaling is maintained, and SIL2 certified, even in case of loss of main power supply. Monitoring of the 24VDC is configurable in INTELLI+ SIL. Thanks to BERNARD CONTROLS SIL certified signaling functions, you can base your decision on a reliable signaling coming from the actuator. BC technology for SIL In addition to a fully dedicated control board designed for SIL requirements, BERNARD CONTROLS has also designed a new absolute position sensor. This absolute 16-bit position encoder features a built in selftest checking permanently photodiodes as well as the consistency of position encoding and communication. BC INTELLI+ standard features Safety and reliability have always been at the heart of BERNARD CONTROLS product development. The proof is the INTELLI+ intelligent integrated control launched more than 10 years ago, and continuously improved thanks to clients feedback and customer-oriented innovation. It thus features key functions that strengthen installation security and ease commissioning, use and maintenance of the MOV: Non-intrusive settings, local & remote control Accurate information with absolute torque and position sensors Increased security and easy maintenance with constant self-monitoring, valve torque curve, torque monitoring Fieldbus communication with Profibus DP, HART, Modbus and Foundation fieldbus protocols Infra-red or Bluetooth communication SIL Actuators 9

10 BERNARD CONTROLS actuators with SIL Explosionproof actuators Adaptation to all types of valves: Quarter turn Multiturn - Linear Adaptation to specifications of engineering companies IP 68 (10m/96h) Compliance with international explosionproof standards: ATEX, INMETRO Brazil, IEC-Ex, GOST-R / CUSTOMS UNION, NEMA 7 & 9... Type of operation: On/Off, Modulating Class III Special configurations: Corrosion protection, Fire protection, Extreme temperatures INTELLI+, intelligent control Easy and fast commissioning Optimized maintenance level MULTITURN STX RANGE STX6 to STX140 (60 to 1400 Nm) MULTITURN ST175 & ST220 (1750 to 2200 Nm) QUARTER-TURN SQX RANGE SQX18 to SQX80 (200 to 800 Nm direct quarter-turn actuators) Weatherproof actuators Adaptation to all types of valves: Quarter Turn Multiturn - Linear Adaptation to specifications of engineering companies IP 68 (5m/72h) Type of operation: On/Off, Modulating Class III INTELLI+, intelligent control Easy and fast commissioning Optimized maintenance level MULTITURN ST & ASM RANGES ST6 to ST220 (60 to 2200 Nm) and ASM0 to ASM3 QUARTER-TURN SQ RANGE SQ20 to SQ80 (200 to 800 Nm) 10

11 LABEL SIL Certified functions Emergency functions - characteristic values ESD OPEN, ESD CLOSE, ESD STAYPUT HFT Hardware fault tolerance 0 λsd Safe failures detected 87,53 FIT λsu Safe failures undetected 6270,18 FIT λdd Dangerous failures detected 1121 FIT λdu Dangerous failures undetected 127,58 FIT T1*=1 year 4,455 E-03 PFDavg Probability of failure on demand T1*=2 year 8,900 E-03 T1*=5 year 2,224 E-02 SFF Safe failure fraction 91.6% SIL Safety integrity level 2 MTBF Mean time between failures h MTTR Mean Time To Repair 8 h *T1 is the proof test interval Signaling functions - characteristic values VALVE OPENED / VALVE CLOSED SIGNALING HFT Hardware fault tolerance 0 λsd Safe failures detected 457,86 FIT λsu Safe failures undetected 2452,89 FIT λdd Dangerous failures detected 9496,61 FIT λdu Dangerous failures undetected 163,50 FIT PFH Probability of dangerous failure per hour 1,962 E-07 SFF Safe failure fraction 98.6% SIL Safety integrity level 2 MTBF Mean time between failures h MTTR Mean Time To Repair 8 h 4/20 ma POSITION SIGNAL HFT Hardware fault tolerance 0 λsd Safe failures detected 457,86 FIT λsu Safe failures undetected 6270,18 FIT λdd Dangerous failures detected 14392,96 FIT λdu Dangerous failures undetected 160,61 FIT PFH * Probability of dangerous failure per hour 1,927 E-07 SFF Safe failure fraction 99.2% SIL Safety integrity level 2 MTBF Mean time between failures h MTTR Mean Time To Repair 8 h *Nota: PFH is not linked to a proof test interval Actuators with SIL 11

12 INTELLI+ SIL layout INTELLI+ CONTROL 12

13 Actuators with SIL 13

14 Technical specifications Type of operation Power supply Enclosure protection Ambient temperature Vibration resistance Double-sealing protection Open/Close input Safety function * with SIL input command Analog input (option) Analog output with SIL2 (option) Signaling relays with SIL2 On/Off or Class III positioning, max number of starts depending on ambient T C and max admissible start specified on the user manual: -40 to 40 C > 360 start/hour max 40 to 60 C > 190 start/hour max 60 to 68 C > 155 start/hour max 3-phase (50 or 60Hz Every voltage up to 690VAC) No automatic phase correction SQ, ASM: IP67 (or IP68-5m/72h in option) ST: IP68 5m/72h SQX/STX: IP68 10m/96h Ambient temperature operating range: Standard: -20 C C ( -4 F F) Low temperature grease option: -40 C C ( -40 F F) 2g (19,6 m/s²) at Hz (tested according to IEC ) For protection of the electronics, the control compartment of the actuator is fully isolated from the wiring compartment: Weather proof design: standard Explosion proof design: standard (except in case of separated box) Isolated by opto-couplers Command by voltage: 10 to 55 and 90 to 250 V DC/AC Command by dry contacts: use INTELLI+ internal DC supply Minimum pulse duration: 100ms SIL2 certified ESD functions - Emergency Open, - Emergency Close, - Emergency Stayput SIL3 certified functions in 1oo2 configuration - Emergency Open: Valves in parallel - Emergency Close: Valves in series Redundant input isolated by opto-couplers Command by voltage: 10 to 55 and 90 to 250 V DC/AC Command by dry contacts: Forbidden Command validated in case of loss of command voltage Standard input signal: 4-20 ma Also possible: Input signal: 0-20 ma or Input signal: 0-10 V in current: impedance of 160 Ohms in voltage: impedance of 11 KOhms 4/20mA current loop (Increasing current = Opening): Fixed parameter External supply between 12 and 30 VDC (750Ω max at 24VDC) Analog output with built-in self-test Opened and closed signaling with SIL2 Limited to actions Contact configuration: SPST latching relays (Contact closed = position reached) Minimum current 10mA at 5V 5A at 250V AC or 5A at 30V DC max. (with resistive load) 14 * We remind you that the activation of ESD functions is subject to power supply of the actuator

15 LABEL Signaling relays Fault relay for safety functions with SIL Fault relay for signaling with SIL Electrical connection Cable entries Power circuit Fuse protection Advanced functions available by fieldbus command 2 relays: each information can be freely selected among a total of 23 available Contact configuration: SPST normally open Minimum current 10mA at 5V 5A at 250V AC or 5A at 30V DC max. (with resistive load) Relay confirming the safety integrity level of the safety functions Contact configuration: SPST Normally open (closed when there s no fault detected) Minimum current 10mA at 5V 5A at 250V AC or 5A at 30V DC max. (with resistive load) Relay confirming the safety integrity level of the signaling (Open, Close, 4/20mA) Contact configuration: SPST Normally open (Closed when there s no fault detected) Minimum current 10mA at 5V 5A at 250V AC or 5A at 30V DC max. (with resistive load) Screw type terminals or ring tongue terminals Standard configurations (other on request): Weatherproof: 3xM20 (additional 4xM16 with fieldbus) Explosion proof: 1>1/2NPT + 2x1>NPT (additional 4x3/4 NPT with fieldbus) Power contactors limited to actions Primary fuse (6.3 x 32mm A) located on the transformer Two automatic fuses for low voltages Partial Stroke Test Auto/On-Off (selection between proportional input and Open/close input) Local control inhibition (and equivalent associated functions) Safety position when losing fieldbus command ( Stayput in standard) BUREAU VERITAS Certificate n Standard IEC Ed2 Part 1, 2, 3, 4. Actuators with SIL 15

16 B E R N A R D C O N T R O L S G R O U P CORPORATE HEADQUARTERS 4 rue d Arsonval - CS / Gonesse CEDEX France / Tel. : +33 (0) / Fax : +33 (0) / mail@bernardcontrols.com CONTACT BY OPERATING AREAS >AMERICA NORTH AMERICA BERNARD CONTROLS UNITED STATES HOUSTON inquiry.usa@bernardcontrols.com Tel SOUTH AMERICA BERNARD CONTROLS LATIN AMERICA inquiry.southamerica@bernardcontrols.com Tel >ASIA CHINA BERNARD CONTROLS CHINA & BERNARD CONTROLS CHINA NUCLEAR BEIJING inquiry.china@bernardcontrols.com Tel. +86 (0) KOREA BERNARD CONTROLS KOREA SEOUL inquiry.korea@bernardcontrols.com Tel SINGAPORE BERNARD CONTROLS SINGAPORE SINGAPORE inquiry.singapore@bernardcontrols.com Tel >EUROPE BELGIUM BERNARD CONTROLS BENELUX NIVELLES (BRUSSELS) inquiry.belgium@bernardcontrols.com inquiry.holland@bernardcontrols.com Tel. +32 (0) FRANCE BERNARD CONTROLS FRANCE & BERNARD CONTROLS NUCLEAR FRANCE GONESSE (PARIS) inquiry.france@bernardcontrols.com Tel. +33 (0) GERMANY BERNARD CONTROLS DEUFRA TROISDORF (KÖLN) inquiry.germany@bernardcontrols.com Tel ITALY BERNARD CONTROLS ITALIA RHO (MILANO) inquiry.italy@bernardcontrols.com Tel RUSSIA BERNARD CONTROLS RUSSIA inquiry.russia@bernardcontrols.com Tel. +33 (0) SPAIN BERNARD CONTROLS SPAIN MADRID inquiry.spain@bernardcontrols.com Tel >INDIA, MIDDLE EAST & AFRICA AFRICA BERNARD CONTROLS AFRICA ABIDJAN - IVORY COAST inquiry.africa@bernardcontrols.com Tel INDIA BERNARD CONTROLS INDIA inquiry.india@bernardcontrols.com Tel MIDDLE-EAST BERNARD CONTROLS MIDDLE-EAST DUBAI - U.A.E. inquiry.middleeast@bernardcontrols.com Tel CAT02-06_ENG_GRP_rev02b All data in this brochure are given for information only and are subject to change without notice. More than 50 agents and distributors worldwide. Contact details on