ABB LLT100, Functional Safety Manual

Page: 13 / 32

Designing an SIF using the LLT100
13
DCS Configuration
For safe fault monitoring, the following conditions must be fulfilled:
• The LOW ALARM must be configured with a value of ≤3.6 mA;
or
• The HIGH ALARM must be configured with a value ≥21.0 mA.
• The DCS must be capable of recognizing the selected configured high alarms or low alarms as a
malfunction detection.
• For safe current output operation, the terminal voltage at the device must be between 15.5 V and
42 V, with a minimum of 21 V for HART functionality.
The DCS loop must provide the required voltage level even if the current output operates on the
configured HIGH alarm.
The DCS shall be able to latch a detected High or Low Alarm, as the LLT100 alarm state may not be
maintained after the alarm-triggering condition is not met anymore.
Power On Behavior
On startup, the LLT 100 current output will follow the following sequence:
1 Low alarm mode (≤ 3.6 mA) for approximately 0.6 s;
2 High alarm mode (≥ 21.0 mA) for a duration between 10 s and 20 s due to internal power
management constraints.
If a CPU fault occurs at startup during the instrument self-test, the current output is in low alarm mode
(≤3.6 mA).
Power Failure Alarm Behavior
As demonstrated through fault insertion testing, some internal hardware failures may cause the LLT100
to undergo a perpetual reset loop behavior which will be similar to its power on behavior as described
above:
1 Low alarm mode (≤ 3.6 mA) for approximately 0.6 s;
2
High alarm mode (≥ 21.0 mA) for approximately 4 s.
Behavior of Transition to Alarm Current
The 4–20 mA output transition from nominal measurement to alarm current is performed in the
following manner:
1 Nominal current output (e.g.; 9.8 mA)
2 Transition to intermediate value for one measurement cycle, thus approximately 1.5 s:
– 4.0 mA if primary value (PV) is set to Ullage
– 20.0 mA if primary value (PV) is set to Level or Volume
3
Alarm current; high or low as described in “Selectable alarm current modes” and “Configurable alarm
currents” on page 12.
Conditions when device is not safety compliant
The device is not safety-compliant during the following conditions:
• During configuration
• When HART multidrop mode is activated