VCIOM-05044
Page 14 of 75
DIgITal EPIC-2 TEChnICal Manual
InstallatIon and operatIng InstructIons
5 SaFETY InSTRuMEnTED
FunCTIOnS
This section provides the required information
needed to design, install, verify and maintain a
Safety Instrumented Function (SIF) utilizing the
Digital EPIC-2 (DEPIC-2) in ESD applications.
This manual provides requirements for
conforming to the IEC 61508 or IEC 61511
functional safety standards.
5.1 rEfErENCEs aNd sTaNdards
listed below are functional safety standards
and references related to the DEPIC-2:
• IEC 61508: 2000 - Functional safety of
electrical/electronic/programmable
electronic safety-related systems.
• IEC 61511 (anSI/ISa 84.00.01-2004)
Functional safety - safety instrumented
systems for the process industry sector.
• naMuR nE-43 Standardization of the signal
level for the failure information of digital
transmitters.
5.2 dEPIC-2 Esd dEsCrIPTION
an ESD valve is a valve that reacts to ensure
that the process is brought to a safe state.
During normal operating conditions, these
ESD valves are typically energized to remain
open/closed depending upon Fail-Closed or
Fail-Open configuration. In case of an unsafe
situation, the ESD valve is de-energized by the
Safety Instrumented System. The DEPIC-2 ESD
device (DEPIC-2 configured for ESD support)
performs this shutdown function for Safety
Instrumented Functions (SIF) which requires
field devices to be certified for safety related
applications in accordance with IEC-61508 as
certified by EXIDa for use up to SIl3 with an
hFT of 0 in low demand applications.
The DEPIC-2 ESD is a valve controller which
mounts on a pneumatically actuated valve
assembly. Its role is to position an emergency
shutdown valve to 0% or 100% with a PFD
avg
in
accordance with IEC-61508 for SIl3 application.
Because of its capability of monitoring data
from its embedded sensors, the DEPIC-2 ESD
is capable of validating the health of its integral
components. In addition, due to the ability to
perform PST and SOVT of the ESD valve while
in normal operations (from energized position),
it becomes possible to validate the health of
the valve and actuator assembly. Configurable
time based testing of the ESD valve (auto PST
and auto SOVT) reduces the PFD
avg
by detecting
dangerous failures or potential dangerous
failures before they become failures thereby
preventing the device from performing its
safety functions on demand.
5.3 dEsIgNINg a sIf usINg a dEPIC-2 Esd
The following points must be taken into
consideration when designing a SIF
(Safety Instrumented Function) using the
DEPIC-2 ESD:
• Safety function
• Environmental limits
• Design verification
• SIl Capability
• Connecting the DEPIC-2 ESD to the SIS
logic-solver
• general requirements
5.3.1 safety function
When de-energized, the DEPIC-2 ESD moves
to its fail-safe position. For a single-acting
PST controller the safe state is when the port
actuator 1 is exhausted to a pressure less than
1 psig (0.069 bar, 6.9 kPa) allowing the actuator
spring to move the valve to its fail-safe position.
For a double-acting PST controller the safe
state is when actuator pressure 1 is equal
or below the actuator pressure 2. The valve
actuation must automatically move the valve to
the safe state when the digital valve controller
falls in safe state.
The DEPIC-2 ESD is intended to be part of the
final element subsystem, as per IEC-61508,
and the achieved SIl level of the function must
be verified by the function designer.
5.3.2 Environmental limits
The designer of a SIF must check that
the product is rated for use within the
environmental limits it is being used.
5.3.3 application limits
listed below are the application limits for the
DEPIC-2 ESD installed in a SIF:
• The application of the DEPIC-2 ESD is limited
for SIF where the safe state is the de-
energized state (shutdown) of the valve. The
device is operated as a position transmitter
with an output loop signal: 4-20 ma or
any user selected range of 3.8-21.0 ma.
Furthermore, the 4-20 ma output shouldn’t
be used as a decision point for safety demand.
• The DEPIC-2 is a non-interfering device
during safety demand. The safety signal
(solenoid voltage) should come from the
safety system. If the device detects SIS
voltage to the solenoid, it is in energized
position. In the absence of SIS voltage, it is
in de-energized or fail-safe position (ESD).
Copyright © Crane Co. All rights reserved.
