7
D5290S-079
- 5 A SIL 3 Relay Output Module
G.M. International ISM0153-2
Functional Safety Manual and Applications
7
D5290S-079
- 5 A SIL 3 Relay Output Module (115 Vac coil voltage)
G.M. International ISM0153-2
Functional Safety Manual and Applications
22
21
20
23
24-19
18-13
17
14
Application D5290S-079 - SIL 2 Load Normally Energized Condition (NE) and Normally Energized Relay:
one common driving signal from PLC for all NE loads (A, B, C and D), with interruption of only one load supply line
D
NE
Load
SIL 2
PLC
Output ON
115 Vac
Normal state operation
De-energized to trip operation
Service
Load B
(Not SIL)
A
NE
Load
SIL 2
16
15
Service
Load A
(Not SIL)
C
NE
Load
SIL 2
B
NE
Load
SIL 2
+ / AC (for load C)
+ / AC (for load B
and its service
load)
+ / AC (for load D)
- / AC (for load C)
- / AC (for load D)
- / AC
(for load A and
its service load)
- / AC
(for load B and
its service load)
22
21
20
23
24-19
18-13
17
14
D
NE
Load
SIL 2
PLC
Output OFF
0 Vac
Service
Load B
(Not SIL)
A
NE
Load
SIL 2
16
15
Service
Load A
(Not SIL)
C
NE
Load
SIL 2
B
NE
Load
SIL 2
+ / AC
(for load A
and service
load A)
+ / AC (for load C)
+ / AC (for load B
and its service
load)
+ / AC (for load D)
- / AC (for load C)
- / AC (for load D)
- / AC
(for load A
and its service
- / AC
(for load B and
its service load)
3)
Input Signal
Pins 1-2 or 3-4
Pins
13-14
Pins
15-16
NE Load A
(SIL 2)
Pins 14-Supply
NE Load C
(SIL 2)
Pins 16-Supply
Service
Load A
High (115 Vac) Closed Closed
Energized Energized De-Energized
Low (0 Vac) Open Open
De-Energized De-Energized
Energized
Service
Load B
De-Energized
Energized
Pins
21-22
Closed
Open
Pins
23-24
Closed
Open
Operation
Normal
Trip
Pins
17-18
Open
Closed
Pins
19-20
Open
Closed
NE Load B
(SIL 2)
Pins 23-Supply
Energized
De-Energized
NE Load D
(SIL 2)
Pins 21-Supply
Energized
De-Energized
Description:
Input Signal from PLC/DCS is normally High (115 Vac) and is applied to pins 1-2 or 3-4 in order to Normally Energize (NE) the internal relays.
Input Signal from PLC/DCS is Low (0 Vac) during “de-energize to trip” operation, in order de-energize the internal relays.
Load A (and Load B, C, D if present) is Normally Energized (NE) therefore its safe state is to be de-energized.
Disconnection of Loads A, B, C, D is done by disconnecting one supply line.
Service Load A (and Service Load B if present) is normally de-energized, therefore it energizes during “de-energize to trip” operation.
The following table describes the status (open or closed) of each output contact when input signal is High or Low.
Safety Function and Failure behavior:
D5290S-079 is considered to be operating in Low Demand mode, as a Type A module, having Hardware Fault Tolerance (HFT) = 0.
In the 3rd Functional Safety application, the normal state operation of relay module is energized, with NE (Normally Energized) loads.
In case of alarm or request from process, the relay module is de-energized (safe state), de-energizing loads.
The failure behaviour of relay module is described by the following definitions:
□
fail-Safe State: it is defined as the output load being de-energized;
□
fail Safe: this failure causes the system to go to the defined fail-safe state without a process demand;
□
fail Dangerous: failure mode that does not respond to a demand from the process (i.e. being unable to go to the defined fail-safe state), so that the output load remains energized.
In addition, there are other definitions of failure behaviours which are not safety-related:
□
fail “No effect”: failure mode of a component that plays a part in implementing the safety function but is neither a safe failure nor a dangerous failure;
□
fail “Not part”: failure mode of a component which is not part of the safety function but part of the circuit diagram and is listed for completeness. When calculating the SFF this
failure mode is not taken into account. It is also not considered for the total failure rate evaluation.
+ / AC
(for load A
and service
load A)
Failure rates table according to IEC 61508:
λ
sd
λ
su
λ
dd
λ
du
SFF
0.00 FIT
48.24 FIT
0.00 FIT
32.00 FIT
60.12%
PFDavg vs T[Proof] table
, with determination of SIL supposing module contributes 10% of entire safety function:
T[Proof] = 1 year
T[Proof] = 7 years
PFDavg = 1.40 E-04 Valid for
SIL 2
PFDavg = 9.81 E-04 Valid for
SIL 2
T[Proof] = 20 years
PFDavg = 2.80 E-03 Valid for
SIL 1
PFDavg vs T[Proof] table
, with determination of SIL supposing module contributes 20% of entire safety function:
Failure rate table:
Failure category
Failure rates (FIT)
λ
dd
= Total Dangerous Detected failures
0.00
λ
du
= Total Dangerous Undetected failures
32.00
λ
sd
= Total Safe Detected failures
0.00
λ
su
= Total Safe Undetected failures
48.24
λ
tot safe
= Total Failure Rate (Safety Function) =
λ
dd
+
λ
du
+
λ
sd
+
λ
su
80.24
λ
not part
= “Not Part” failures
0.00
λ
tot device
= Total Failure Rate (Device) =
λ
tot safe
+
λ
no effect
+
λ
not part
92.00
MTBF (device, single channel) = (1 /
λ
tot device
) + MTTR (8 hours)
1240 years
MTTF
S
(Total Safe) = 1 / (
λ
sd
+
λ
su
) 2366
years
MTTF
D
(Dangerous) = 1 /
λ
du
3567 years
λ
no effect
= “No effect” failures
11.76
MTBF (safety function, single channel) = (1 /
λ
tot safe
) + MTTR (8 hours)
1422 years
T[Proof] = 1 year
T[Proof] = 14 years
PFDavg = 1.40 E-04 Valid for
SIL 2
PFDavg = 1.96 E-03 Valid for
SIL 2
T[Proof] = 20 years
PFDavg = 2.80 E-03 Valid for
SIL 1
