Safety Manual VEGAPULS series 60

Transcription

1 Safety Manua VEGAPULS series ma/hart Radar

2 Contents Contents 1 Functiona safety 1.1 In genera Panning Instrument parameter adjustment Setup Reaction during operation and in case of faiure Recurring function test Safety-reated characteristics VEGAPULS series ma/hart

3 Functiona safety 1 Functiona safety 1.1 In genera Scope This safety manua appies to measuring systems consisting of the VEGAPULS series 60 radar sensor in two-wire and fourwire versions 4 20 ma/hart: VEGAPULS 61, 62, 63, 65, 66, 67, 68 Vaid hardware and software versions: Seria number of the eectronics Sensor software VEGAPULS 61, 62, 63, 65, 66 VEGAPULS 61, 62, 63 with increased sensitivity > from rev > from rev VEGAPULS 67, 68 > from rev Area of appication SIL conformity Abbreviations, terms The measuring system can be used for eve measurement of iquids and soids which meet the specific requirements of the safety technoogy. This is possibe up to SIL2 in a singe channe architecture (1oo1D), and up to SIL3 in a mutipe channe, diverse redundant architecture. The use of the measuring system in a mutipe channe, homogeneous redundant architecture is excuded. The SIL decaration of conformity can be downoaded from our homepage in the Internet. Further abbreviations and terms are stated in IEC SIL HFT SFF PFD avg PFH Safety Integrity Leve Hardware Faut Toerance Safe Faiure Fraction average Probabiity of dangerous Faiure on Demand Probabiity of a dangerous Faiure per Hour FMEDA Faiure Mode, Effects and Diagnostics Anaysis λ sd λ su Rate for safe detected faiure Rate for safe undetected faiure VEGAPULS series ma/hart 3

4 Functiona safety λ dd λ du Rate for dangerous detected faiure Rate for dangerous undetected faiure DC S Diagnostic Coverage of safe faiures; DC S = λ sd /(λ sd +λ su ) DC D Diagnostic Coverage of dangerous faiures; DC D = λ dd /(λ dd +λ du ) FIT Faiure In Time (1 FIT = 1 faiure/10 9 h) MTBF MTTF MTTR Mean Time Between Faiure Mean Time To Faiure Mean Time To Repair Reevant standards Safety requirements IEC (aso avaiabe as DIN EN) - Functiona safety of eectrica/eectronic/programmabe eectronic safety-reated systems IEC Functiona safety - safety instrumented systems for the process industry sector - Part 1: Framework, definitions, system, hardware and software requirements Faiure imit vaues for a safety function, depending on the SIL cass (of IEC , 7.6.2) Safety integrity eve Low demand mode High demand mode SIL PFD avg PFH < < < < < < < <10-5 Safety integrity of hardware for safety-reated subsystems of type B (IEC , 7.4.3) Safe faiure fraction Hardware faut toerance SFF HFT = 0 HFT = 1 (0) HFT = 2 <60 % not permitted SIL1 SIL2 60 % <90 % SIL1 SIL2 SIL3 90 % <99 % SIL2 SIL3 (SIL4) 99 % SIL3 (SIL4) (SIL4) 4 VEGAPULS series ma/hart

5 Functiona safety Proven in use According to IEC , paragraph , the faiure toerance HFT can be reduced by one for proven-in-use subsystems if the foowing conditions are met: The instrument is proven in use Ony process-reevant parameters can be modified on the instrument (e.g. measuring range, current output in case of faiure ) The modification of these process-reevant parameters is protected (e.g. password, ) The safety function requires ess than SIL4 The assessment of the modification management was part of the proof for "Proven in use". 1.2 Panning Safety function Safe state The measuring system generates on the current output a signa between 3.8 ma and 20.5 ma corresponding to the eve. This anaogue signa is transmitted to a connected processing unit to monitor the foowing conditions: Exceeding a preset eve Faing beow a preset eve When the switching point set on the processing unit is reached, a signa is outputted. The safe state depends on the mode: Safe state Monitoring upper eve Exceeding the switching point Monitoring ower eve Faing beow the switching point Output current in safe state > switching point (-1 %) < switching point (+1 %) Faiure current "fai ow" <3.6 ma <3.6 ma Faiure current "fai high" >21.5 ma >21.5 ma The current toerance ±1 % refers to the fu measuring range of 16 ma. Faut description A safe faiure is present when the measuring system switches to the defined safe state or the faut mode without the process demanding it. VEGAPULS series ma/hart 5

6 Functiona safety If the interna diagnosis system detects a faiure, the measuring system goes into faut mode. A dangerous undetected faiure exists if the measuring system switches neither to the defined safe condition nor to the faiure mode when the process requires it. Configuration of the processing unit Low demand mode If the measuring system deivers output currents of "fai ow" or "fai high", it can be assumed that there is a mafunction. The processing unit must therefore interpret such currents as a mafunction and output a suitabe faut signa. If this is not the case, the corresponding portions of the faiure rates must be assigned to the dangerous faiures. The stated vaues in chapter "Safety-reevant characteristics" can thus worsen. The processing unit must correspond to the SIL eve of the measurement chain. If the demand rate is ony once a year, then the measuring system can be used as safety-reevant subsystem in "ow demand mode" (IEC , ). If the ratio of the interna diagnostics test rate of the measuring system to the demand rate exceeds the vaue 100, the measuring system can be treated as if it is executing a safety function in the mode with ow demand rate (IEC , ). An associated characteristic is the vaue PFD avg (average Probabiity of dangerous Faiure on Demand). It is dependent on the test interva T Proof between the function tests of the protective function. Number vaues see chapter "Safety-reated characteristics". High demand mode If the "ow demand rate" does not appy, the measuring system as safety-reevant subsystem in "high demand mode" shoud be used (IEC , ). The faut toerance time of the compete system must be higher than the sum of the reaction times or the diagnostics test periods of a components in the safety-reated measurement chain. An associated characteristic is the vaue PFH (faiure rate). Number vaues see chapter "Safety-reated characteristics". 6 VEGAPULS series ma/hart

7 Functiona safety Assumptions Genera instructions and restrictions The foowing assumptions form the basis for the impementation of FMEDA: Faiure rates are constant, wear of the mechanica parts is not taken into account Faiure rates of externa power suppies are not taken into account Mutipe errors are not taken into account The average ambient temperature during the operating time is 40 C (104 F) The environmenta conditions correspond to an average industria environment The ifetime of the components is around 8 to 12 years (IEC , , remark 3) The repair time (exchange of the measuring system) after an nondangerous mafunction is eight hours (MTTR = 8 h) The processing unit can interprete "fai ow" and "fai high" faiures as errors and trigger a suitabe error message Existing communication interfaces (e.g. HART, I²C-Bus) are not used for transmission of safety-reevant information The measuring system shoud be used appropriatey taking pressure, temperature, density, dieectric vaue and chemica properties of the medium into account. Instructions to critica process and vesse situations are described in the operating instructions manua. The user-specific imits must be kept. The specifications of the operating instructions manua must not be exceeded. 1.3 Instrument parameter adjustment Adjustment toos Since the pant conditions infuence the safety of the measuring system, the instrument parameters must be set according to the appication. The foowing toos are aowed: the DTM suitabe for VEGAPULS in conjunction with an adjustment software according to the FDT/DTM standard, e.g. PACTware Indicating and adjustment modue Note: Make sure that DTM-Coection 10/2005 or a newer version is used. VEGAPULS series ma/hart 7

8 Functiona safety Create a measurement oop Reaction in case of faiure Damping of the output signa Inadmissibe modes Inspection possibiities Access ocking In the adjustment software, the parameter "Sensor according to SIL" must be seected in the menu eve "Basic adjustment". If the indicating and adjustment modue is used, the parameter "SIL" must be actived in the menu eve "Service". The parameter adjustment of the interference current infuences the safety-reated characteristics. For safety-reevant appications ony the foowing interference currents are permitted: fai ow = <3.6 ma (defaut vaue) fai high = 22 ma The damping of the output signa must be adapted to the process safety time. Measured vaue transmission via HART signa as we as HART mutidrop mode is not permitted. The effectivity of the set parameters must be checked in a suitabe way. After connecting the instrument, the output signa jumps to the set interference current (at the end of the switch on phase) In mode "Simuation", the signa current can be simuated independent of the actua eve To avoid unwanted or unauthorized modification, the set parameters must be protected against unintentiona access: activate the password protection in the adjustment software Activate the PIN on the indicating and adjustment modue The access by means of HART handhed or simiar is not permitted. Protecting against unintentiona or unauthorized adjustment can be done, e.g. by seaing the housing cover. Caution: After a reset of the vaues, a parameters must be checked or readjusted. 8 VEGAPULS series ma/hart

9 Functiona safety 1.4 Setup Mounting and instaation Take note of the mounting and instaation instructions of the operating instructions manua. In the setup procedure, a check of the safety function by means of an initia fiing is recommended. 1.5 Reaction during operation and in case of faiure The adjustment eements or device parameters must not be modified during operation. If modifications have to be made during operation, carefuy observe the safety functions. Faut signas that may appear are described in the appropriate operating instructions manua. If fauts or error messages are detected, the entire measuring system must be shut down and the process hed in a safe state by other measures. An exchange of the eectronics is easiy possibe and is described in the operating instructions manua. If due to a detected faiure the eectronics or the compete sensor is exchanged, the manufacturer must be informed (inc. a faut description). 1.6 Recurring function test In genera The recurring function test is used to check the safety function, to detect possibe non-detectabe dangerous fauts. The function of the measuring system must be checked in adequate intervas. The operator is responsibe for choosing the type of check. The time intervas depend on the seected PFD avg vaue according to chart and diagram in paragraph "Safety-reated characteristics". With high demand rate, a recurring function test is not requested in IEC The function of the measuring system is demonstrated by the frequent use of the system. In doube channe architectures it is a good idea to verify the redundancy through recurring function tests at appropriate intervas. VEGAPULS series ma/hart 9

10 Functiona safety The test must be carried out in a way that verifies the fawess operation of the safety functions in conjunction with a system components. This is ensured by a controed reaching of the response height during fiing. If fiing up to the response height is not possibe, then a response of the measuring system must be triggered by a suitabe simuation of the eve or the physica measuring effect. The methods and procedures used during the tests must be stated and their suitabiity must be specified. The tests must be documented. If the function test proves negative, the entire measuring system must be switched out of service and the process hed in a safe state by means of other measures. In the doube channe architecture 1oo2D this appies separatey to both channes. 1.7 Safety-reated characteristics Basics Service ife Faiure rates The faiure rates of the eectronics, the mechanica parts of the transmitter as we as the process fitting are determined by an FMEDA according to IEC The cacuations are based on component faiure rates according to SN A vaues refer to an average ambient temperature during the operating time of 40 C (104 F). For a higher average temperature of 60 C (140 F), the faiure rates shoud be mutipied by a factor of 2.5. A simiar factor appies if frequent temperature fuctuations are expected. The cacuations are aso based on the specifications stated in chapter "Panning". After 8 to 12 years, the faiure rates of the eectronic components wi increase, whereby the derived PFD and PFH vaues wi deteriorate (IEC , , note 3). Appies to overfi and dry run protection: λ sd 0 FIT λ su λ dd λ du 461 FIT 1129 FIT 358 FIT DC S 0 % 10 VEGAPULS series ma/hart

11 Functiona safety DC D 75 % MTBF = MTTF + MTTR 0.45x10 6 h Faut reaction time VEGAPULS 61, 62, 63 E013 (no measured vaue avaiabe) E042/E043 (hardware error) E036/E037 (no executabe sensor software) 2 20 min depending on the appication <2 min <25 h VEGAPULS 65, 66 E013 (no measured vaue avaiabe) E042/E043 (hardware error) E036/E037 (no executabe sensor software) 2 8 min depending on the appication <2 min <15 h VEGAPULS 68 and VEGAPULS 61, 62, 63 with increased sensitivity E013 (no measured vaue avaiabe) E042/E043 (hardware error) E036/E037 (no executabe sensor software) 2 36 min depending on the appication <4 min <80 h Specific characteristics Singe channe architecture 1oo1D SIL SIL2 HFT 0 Sensor type Type B Appies to overfi and dry run protection: SFF 81 % PFD avg T Proof = 1 year T Proof = 5 years <0.157x10-2 <0.779x10-2 VEGAPULS series ma/hart 11

12 Functiona safety PFH <0.358x10-6 /h Time-dependent process of PFD avg The chronoogica sequence of PFD avg is neary inear to the operating time over a period up to 10 years. The above vaues appy ony to the T Proof interva after which a recurring function test must be carried out. 4 PFD avg T Proof Fig. 1: Chronoogica sequence of PFD avg (figures see above charts) 1 PFD avg = 0 2 PFD avg after 1 year 3 PFD avg after 5 years 4 PFD avg after 10 years Specific characteristics Mutipe channe architecture If the measuring system is used in a mutipe channe architecture, the safety-reevant characteristics of the seected structure of the meas. chain must be cacuated specificay for the seected appication according to the above faiure rates. A suitabe Common Cause Factor must be taken into account. The measuring system must ony be used in a diversitary redundant architecture! 12 VEGAPULS series ma/hart

13 Functiona safety VEGAPULS series ma/hart 13

14 Functiona safety 14 VEGAPULS series ma/hart

15 Functiona safety VEGAPULS series ma/hart 15

16 VEGA Grieshaber KG Am Hohenstein Schitach Germany Phone Fax E-mai: ISO 9001 A statements concerning scope of deivery, appication, practica use and operating conditions of the sensors and processing systems correspond to the information avaiabe at the time of printing. VEGA Grieshaber KG, Schitach/Germany 2007 Subject to change without prior notice