Loreme CAL4/100ig Safety Manual

4-20mA signal isolator, signal splitter with 2,3,4 outputs SIL2 / SIL3 CAL4/100ig CAL4/100igM Commissioning and safety manual LOREME 12, rue des Potiers d'Etain Actipole BORNY - B.P. 35014 - 57071 METZ Phone 03.87.76.32.51 - Fax 03.87.76.32.52 Contact: [email protected] - [email protected] Download manual on: www.loreme.fr CAL4-100ig-SIL REV4 ind0 -12/09/18 writing : KR verified : PH Approved : PD Following of document Date Index Initial version 12/09/18 00

E 2 Table of content 1 Introduction E3 1.1 General Information E3 1.2 Functions and intended uses E3 1.3 Standards and Guidelines E3 2 Safety function and safety state E4 2.1 Safety function E4 2.2 Safety fallback position E4 3 Safety Recommendation E4 3.1 Interfaces E4 3.2 Configuration / Calibration E4 3.3 Useful lifetime E4 4 Installation, commissioning and replacement E5 4.1 Front panel description E5 4.2 Electrical connection E6 4.3 Wiring E6 5 Commissioning and periodic proof E7 5.1 control steps E7 5.2 proof interval E7 FMEA summary E8-E9 SIL2/SIL3 Declaration of conformity E10 Annex 1 : EMC CONSIDERATION E11 Annex 2 : terms and definitions. E12

SIL2 / SIL3 CAL4/100ig CAL4/100igM 1 Introduction 1.1 General information This manual contains necessary informations for product integration to ensure the functional safety of related loops. All the failure and the HFT of the module are specidied in the FMEA analysis Other documents ---Applicables: - Technical datasheet CAL4-100ig - UE conformity declaration CAL4-100ig - FMEA analysis AMDEC_CAL4-100ig The mentioned documents are available on www.loreme.fr The assembly, installation, commissioning and maintenance can only be performed by trained personnel, qualified and have read and understood the instructions in this manual. When it is not possible to correct the defects, the equipment must be decommissioned, precaution must be taken to protect against accidental use. Only the manufacturer can bring the product to be repaired. Failure to follow advice given in this manual can cause a deterioration in security features, and damage to property, environment or people. 1.2 Functions and intended uses The transducer CAL4-100ig provides isolation and duplication of analog current loop 4 ....20mA. an auxiliary power supply for a loop powered sensor is available. The devices are designed, manufactured and tested according to security rules. They should be used only for the purposes described and in compliance with environmental conditions contained in the data sheet: http://www.loreme.fr/fichtech/CAL4-100ig_eng.pdf 1.3 Standards and Guidelines The devices are evaluated according to the standards listed below: • Functional safety according to IEC 61508, 2000 edition: Standard for functional safety of electrical / electronic / programmable electronic relative to electronic safety. The evaluation of the material was performed by "failure modes and effects analysis" (IEC 60812 - Issue 2 - 2006) to determine the device safe failure fraction (SFF) The FMEA is based on (IEC 62380-2004) Reliability data handbook. Universal model for reliability prediction of electronics components, PCBs and equipment 1.4 Manufacturer information LOREME SAS 12, rue des potiers d'étain 57071 Actipole Metz Borny www.loreme.fr

E 4 2 Safety function and safety state 2.1 Safety function The safety function of the device is completed, as long as the outputs reproduce the input current (4 ... 20 mA) with a tolerance of +/- 1%. The operation range of the output signal goes from 3.8 mA to 20.5 mA 2.2 Safety fallback position (according to NAMUR NE 43) The safety fallback state is defined by an output current outside the range of 3.6 mA to 21mA. • Either an output current < 3.6 mA • Either an output current > 21 mA The application should always be configured to detect the current value out of range (<3.6 mA -> 21 mA) and considered "faulty ". Thus, in the FMEA study, this condition is not considered dangerous. The reaction time for all safety functions is < 30 ms. 3 Safety Recommendation 3.1 Interfaces The device has the following interfaces. • safety interfaces: input, output 1, output 2, (and input 2 output 3, output 4 in option) • not safety interfaces : no 3.2 Configuration / Calibration no hardware configuration is needed, the calibration is only possible by return to factory. no changes should be made to the device 3.3 Useful lifetime Evolution of failure rate Although a constant failure rate is assumed by the probabilistic estimation, that it applies only to the useful lifetime of components. Beyond this lifetime, the probability of failure is increasing significantly with time. The useful lifetime is very dependent components themselves and operating conditions such as temperature, particularly (Electrolytic capacitors are very sensitive to temperature). This assumption of a constant failure rate is based on the bathtub curve, which shows the typical behavior of electronic components. Therefore, the validity of this calculation is limited to the useful life of each component. It is assumed that early failures are detected for a very high percentage during the burn in and the installation period, assuming a constant failure rate during the useful life remains valid. according to IEC 61508-2, a useful lifetime based on the feedback, must be considered. Experience has shown that the useful lifetime is between 15 and 20 years, and may be higher if there are no components with reduced lifetime in security function. (Such as electrolytic capacitors, relays, flash memory, opto coupler) and if the ambient temperature is well below 60 °C. Note: The useful lifetime corresponds to constant random failure rate of the device. The effective lifetime may be higher. User must ensure that the device is no longer necessary for the security before its disposal. 4-20mA signal isolator, signal splitter with 2,3,4 outputs SIL2 / SIL3 CAL4/100ig CAL4/100igM Birth defect End of life wear-out

Operating capacity and current error reporting should be checked during commissioning (validation) see section: "commissioning and periodic proof" and at appropriate intervals recommended in paragraph: " proof interval " Any device that does not satisfy the commissioning control must be replaced. WARNING! No user maintenance should be conducted, a defective device must be replaced by a new device of the same type. For a repair return or a recalibration, it is very important that all types of equipment failures are reported to allow the company to take corrective action to prevent systematic errors. 4.1 Front panel description Convention: - The green LED indicate correct operation. - The red LED indicate a warning or a defect. 4-20mA signal isolator, signal splitter with 2,3,4 outputs SIL2 / SIL3 CAL4/100ig CAL4/100igM Green LED "Power" indicates that the device is cor- rectly power on. Blink if power is on protected mode. (under voltage supply, overload or thermal protection mode) Green LED pass through by the output current 4 indicates that the output loop current is closed. (current flow) light off when opening the output loop and when using test terminals located under the front panel Green LED pass through by the output current 3 indicates that the output loop current is closed. (current flow) light off when opening the output loop and when using test terminals located under the front panel Green LED pass through by the output current 2 indicates that the output loop current is closed. (current flow) light off when opening the output loop and when using test terminals located under the front panel Green LED pass through by the output current 1 indicates that the output loop current is closed. (current flow) light off when opening the output loop and when using test terminals located under the front panel

E 6 4.2 Electrical connection * Device power supply : between terminal A + and terminal B - . The module is insensitive to power polarity The polarity is given as a guide for the implementation of schemes (device working with AC or DC supply). * Output 1: - mirror of input 1. Active mode (device supplied the output current): Terminal O + and terminal P - * Output 2: - mirror of input 1. Active mode (device supplied the output current): Terminal M + and terminal N - * Output 3: - mirror of input 2. Active mode (device supplied the output current): Terminal K + and terminal L - * Output 4: - mirror of input 2. Active mode (device supplied the output current): Terminal I + and terminal J - WARNING ! Do not wire loop with its own power supply on the active output otherwise the device can be damaged . Do not exceed the technical specifications to ensure output safe operation. - In Active mode, the output load resistance must be between 0 ohms and 600 ohms. Input wiring : In 4/20mA passive current input : between terminal in + and GND (for active transmitter) In 4/20mA loop with transmitter supply : between terminal +22V and in+ (for loop powered transmitter) (inputs being isolated , they can be put in series to have 4 outputs. See following diagram) * Input 1: two operating mode are available ( active mode or passive mode) - Passive input mode (the input transmitter should supply current) : terminal E+ and terminal D- - Active input mode (The device supply the input transmitter) : terminal C (+22V) and terminal E - * Input 2: two operating mode are available ( active mode or passive mode) - Passive input mode (the input transmitter should supply current) : terminal H+ and terminal G- - Active input mode (The device supply the input transmitter) : terminal F (+22V) and terminal H - WARNING ! - Do not short the sensor power supply (terminal C) otherwise the device can be damaged 4.3 Wiring wiring in series of 2 inputs with transmitter supply wiring in series of 2 passive inputs Hinged cover. Access to Test terminals 4-20mA signal isolator, signal splitter with 2,3,4 outputs SIL2 / SIL3 CAL4/100ig CAL4/100igM

According table 2 from CEI 61508-1 the PFDavg ,for systems operating in low demand mode, must be between ≥ 10-3 and <10-2 for SIL2 safety functions and between ≥ 10-4 and <10-3 for SIL3 safety functions . T[Proof] = 1 year T[Proof] = 5 years T[Proof] = 10 years T[Proof] = 20 years PFDavg=7.88E-06 PFDavg=3.94E-05 PFDavg=7.88E-05 PFDavg=1.57E-04 temperature conditions 45°C PFDavg value depending proof interval λsafe λdangerous = PFH SFF 305 FIT 1.8 FIT 99.4% approximation : PFDavg = λdangerous x T[Proof] /2 (error caused by approximation < 3%) Fields marked in green means that the calculated values of PFDavg are within the limits allowed for SIL 3 Summary: Fault probability PFD = 7.88 E-6 x Tproof [year] either for : Tproof = 10 years 8 % from SIF and for Tproof = 20 years 16 % from SIF in SIL3 Remarks : - Test intervals should be determined according to the PFDavg required . - The SFF , PFDavg and PFH must be determined for the entire safety instrumented function (SIF) ensuring that the " out of range current values" are detected at system level and they actually lead to the safety position. 5 Commissioning and periodic proof The periodic test procedure is defined by LOREME and must be followed by the end user to ensure and guarantee the SIL level over time. Periodic testing should be performed following the procedure defined below and at the intervals defined under paragraph " proof interval " 5.1 control steps Periodic proof allows detection of possible product internal failure and loop calibration. environmental conditions and a minimum heating time of 5 minutes must be respected. Isolator test and complete output Loop control (the system is unavailable during the test) 1. If necessary, bypass the security system and / or take appropriate provision to ensure safety during the test. 2. Disconnect the current input transmitter. 3. Using a current simulation device (note 1), set the input current to high alarm value (≥ 21.0 mA). 4. Raise the front cover of device. With the TEST terminals and a milliammeter, check if each output current have this value within +/- 1%. (the green LED of each output is light off when the milliammeter is connected) 5. Set the input current to the low alarm value (≤ 3.6 mA) 6. Check if the signal from each output reaches this value within +/-1% 7. Set the output current to a median value (= 12 mA) 8. Check if the signal from each output reaches this value at +/-1% (linearity and transfer function check) 9. Remove the input simulator, close the front panel and connect the transmitter input . 10. Remove the bypass on the safety controller system or return to a normal operating condition 11. After testing, the results should be documented and archived. Any device that does not satisfy the control needs to be replaced. Note 1: The current generator must be calibrated (according to the state of the art and practice) 4-20mA signal isolator, signal splitter with 2,3,4 outputs SIL2 / SIL3 CAL4/100ig CAL4/100igM

E 8 4-20mA signal isolator, signal splitter with 2,3,4 outputs SIL2 / SIL3 CAL4/100ig CAL4/100igM FMEA summary Overview This document summarizes the results of the Failure Modes, and Effects Analysis (FMEA) of the isolator CAL4-100ig from LOREME manufacturer. In addition to the characterization of information required for the operational safety ( especially for the availability and storage of spares parts ), this study fulfills the requirement of IEC-61508 by indentify and quantify the dangerous failures of the component, thus allowing to interact on design for reduce this risks. Purpose of analysis This study was made in order to verify the suitability of the isolator CAL4-100ig to be used in SIL2 or SIL3 safety applications. Scope of analysis The dedicate device embedded a set of electronic components for acquiring a 4-20mA current input signal from a sensor and reproducing two analog output signals (4-20mA), image of input. Generally, a transducer is taking place between a sensor and a protective equipment, designated as "Logic Safety Equipment" Sensor transmitter CAL4-100ig PLC / Logic Safety Equipment Analog output 2 Analog output 1 PLC / Logic Safety Equipment Specification of device The converter CAL4-100ig is a subsystem of type "A" according to [CEI61508-2-§ 7.4.3.1.2] : The failure modes of components required for the safety function are well defined. The behaviour of the converter in fault conditions is fully defined. The converter benefits from a experience feedback in many safety application. Safe failure [CEI61508-4-§3,6.8] Failure that does not have the potential to put the safety system in a dangerous or fail to function state. A safe failure it is not dangerous failure. SFF [CEI61508-2-§7.4.3.1.1-d] The Safe Failure Fraction is the proportion of non-hazardous failures. It describe the frac- tion in percent of safe failures S and detected dangerous failures DD related to the total failure rate (sum of safe failures S and dangerous failures D). D S DD S SFF        Dangerous failure [CEI61508-4-§3,6.7] Also designated as unsafe failures. It is failures that have the potential to put the safety system in a dangerous or fail to function state.

SIL2 / SIL3 CAL4/100ig CAL4/100igM Functional analysis The converter consist of : an power stage two analog input stage two isolation stage (signal transmission) two output stage (current amplifier) Dreaded event definition For the converter CAL4-100ig, the dreaded event (i.e the dangerous failure as defined in the previous section) it's to supply an wrong output current : Either an erroneous output current of more than 1% compared to the process demand, either an output current, blocked to a value, such as it is not possible to have a security fallback state : output current blocked in the range >3.6mA or <21mA. Therefore in the impossibility to transmitting an alarm. Security fallback definition The security fallback state is defined with an output current out of the range 3.6mA - 21mA. Either an output current =< 3.6 mA Either an output current >= 21mA The application program of the "Logic safety equipment" shall be configured to detect all current values out of range (=< 3.6mA and >= 21mA) and considered them as "invalidate". Thereby, in the FMEA analysis, this state is considered as a not dangerous state. Study hypotheses The failure rate of component are considered as constant for the all system life time. The evaluation of the safety features of a device involves a number of assumptions: Only the catalectic failures are taken in account : straight, sudden, or unpredictable failures. Are not considered the failures that could be due to: - design errors - batch defect in production - environment (electrical interference, temperature cycles, vibrations) - human errors in operation or maintenance Precautions are taken to avoid them: management of a L.O.F.C (List of manufacturing operation and control) Only simple fault are handled. Welding defect, which are usually due to a lack of quality detectable at the end of pro- duction by a specific burn-in, are not taken into account. All aspects of power-on specific features are not treated. Failure rate The simple failure rate for the components of the converter CAL4-100ig are classified on the document: AMDEC CAL4-100ig rev4.XLS ( internal document not communicated for reasons of design confidentiality) Created with "ALD MTBF calculator" according to the reliability reports : - MIL-HDBK-217F Notice 2 Electronic Reliability Prediction et iec-tr-62380.e Reliability data handbook

E 10 4-20mA signal isolator, signal splitter with 2,3,4 outputs SIL2 / SIL3 CAL4/100ig CAL4/100igM DECLARATION OF CONFORMITY REV1 Page 1/1 The LOREME society declare under its sole responsibility, that the following product : Designation: Isolator 4-20mA current loop splitter Type: CAL4-100ig Revision : 4 date : 07/04/2011 Can be used for functional safety application up to SIL3 according to standard : IEC61508-2 : 2000 respecting the safety instructions specified in the safety manual. The assessment of the safety critical and dangerous random failure give the following values: Device with type A components, hardware fault tolerance HFT = 0 (1) according to AMDEC CAL4-100ig rev4 created with "ALD MTBF calculator" : http://www.aldservice.com/ Standard : CEI 62380 2004-08 (2) FIT = Failure rate (1/h) Metz, the : 18/01/2016 Signed on behalf of LOREME; M. Dominique Curulla λf λ dangerous undetected = PFH SFF (1) DC PFDavg T[Proof] = 1 an PFH 265 FIT(2) @30°C 305 FIT(2) @45°C 1.5 FIT(2)@30°C 1.8 FIT(2)@45°C 99.4 % 88.8%@30°C 85.0%@45°C 6.57E-06@30°C 7.88E-06@45°C 1.53E-09 1/h@30°C 1.8E-09 1/h@45°C

1) Introduction: In order to satisfy its policy of Electromagnetic compatibility, based on the EU Directive 89/336/EC, LOREME company takes into account the standards relative to this directive early in the design of each product. All tests performed on devices designed to work in industrial environment, are compliant to EN 50081-2 and EN 50082-2 in order to establish the EMC compliance certificate. The devices being in some typical configurations during the test, it is impossible to guarantee results in all possible configurations. To ensure optimum operation of each device ,it would be judicious to comply with several recommendations of use. 2) Recommendations: 2.1) General information: - Comply with the mounting recommendations (mounting direction, devices spacing ...) specified in the datasheet. - Follow the recommendations of use (temperature range, protection) specified in the datasheet. - Avoid dust and excessive moisture, corrosive gases, sources of heat. - Avoid disturbed environments and disruptive phenomena. - If possible, group together the instrumentation devices in a zone separated from the power and relay circuits. - Avoid close proximity with remote switches for high power, contactors, relays, SCR ,... - Do not approach within two feet of a device with a walkie-talkie ( 5 W output power), because it creates a electromagnetic field with an intensity greater than 10 V / M for a distance of less than 50 cm. 2.2 ) Power supply: - Observe the characteristics specified in the datasheet (Voltage and frequency tolerance). - It is preferable that the power comes from a system with section switches equipped with fuses for instrumentation components, and the supply line is the most direct route possible from the section switch. Avoid using this power supply to control relays, contactors, solenoid valves, … - If the power circuit is heavily disturbed by SCR switching , motor, inverter, ... it may be necessary to install an isolation transformer specifically for instrumentation and connecting the screen to ground. - It is also important that the installation has a good grounding, and preferable that the voltage compared to neutral does not exceed 1V, and the ground resistance less than 6 ohms. - If the installation is located near high frequency generators or arc welding, it is preferable to mount adequate power line filter. 2.3) Inputs / Outputs: - In harsh conditions, it is advisable to use sheathed twisted cables whose ground braid will be grounded at on point. - It is advisable to separate the input/output lines from the power supply lines in order to avoid the coupling phenomena. - It is also advisable to minimize the lengths of data cables. 4-20mA signal isolator, signal splitter with 2,3,4 outputs SIL2 / SIL3 CAL4/100ig CAL4/100igM

E 12 Abbreviation Description HFT Hardware Fault Tolerance, capability of a functional unit to continue the execution of the demanded function when faults or anomalies exist. MTBF Mean interval between two failures MTTR Mean interval between the occurrence of the failure in a device or system and its repair PFD Probability of a dangerous failure of a system on demand PFDavg Average of probability of dangerous failure of a system on demand SIL Safety Integrity Level, the international standard IEC 61508 defines four discrete safety integrity levels (SIL1 to SIL4). Each level corresponds to a specific probability range with respect to the failure of a safety function. The higher the integrity level of the safety-related system, the lower the likelihood of the demanded safety functions not occurring. SFF Safe Failure Fraction, the proportion of failures without the potential to put the safety-related system into a dangerous or impermissible functional state. TProof In accordance with IEC 61508-4, chapter 3.5.8, TProof is defined as the periodic testing to expose errors in a safety-related system. XooY Classification and description of the safety-related system with respect to redundancy and the selection procedure used. "Y" indicates how often the safety function is carried out (redundancy). "X" determines how many channels must work properly. λsd and λsu λsd Safe detected + λsu Safe undetected Safe failure (IEC 61508-4, chapter 3.6.8): A safe failure is present when the measuring system switches to the defined safe state or the fault signaling mode with out the process demanding it. λdd and λdu λdd Dangerous detected + λdu Dangerous undetected Unsafe failure (IEC 61508-4, chapter 3.6.7): Generally a dangerous failure occurs if the measuring system switches into a dangerous or functionally inoperable condition. λdu λdu Dangerous undetected. A dangerous undetected failure occurs if the measuring system doesn't switch into a define safe state, or into an alarm signaling mode on process demand. Appendix : term and definitions. SIL stands for "Security Integrity Level", which is the level of integrity of security. The concept of SIL has been introduced in the IEC61508 standard and is incorporated in standards derived from IEC61508, such as the IEC61511 standard for safety instrumented systems (SIS) for processes and IEC62061 for safety systems with programmable electronics for machines. When you want to make a security application, you have to start by assessing the risk (its dangerousness, its frequency of occur- rence), which leads to defining the security requirements that we expect from the SIS. to say its SIL. Ultimately, the SIL defines the level of reliability of the SIS. There are two ways to define the SIL, depending on whether the security system operates in low demand mode or if on the contrary it operates continuously or with high demand. There are 4 levels of SIL (rated SIL1 to SIL4) higher the SIL level, higher the availability of the security system. For Safety system operating in low demand mode, The failure measure is based on average Probability of dangerous Failure on Demand ( PFDavg ) with a 10 years period. The relationship between SIL level and PFDavg are following: SIL 4 : PFDavg from 10-5 to 10-4 SIL 3 : PFDavg from 10-4 to 10-3 SIL 2 : PFDavg from 10-3 to 10-2 SIL 1 : PFDavg from 10-2 to 10-1 For Safety system operating in high demand mode, The failure measure is based on average Frequency of Dangerous failure per hour. relationship between level and PFH are following: SIL 4 : PFH from 10-9 to 10-8 SIL 3 : PFH from 10-8 to 10-7 SIL 2 : PFH from 10-7 to 10-6 SIL 1 : PFH from 10-6 to 10-5 4-20mA signal isolator, signal splitter with 2,3,4 outputs SIL2 / SIL3 CAL4/100ig CAL4/100igM SIL levels scale : Mode of operations SIL* Low demand PFD** High demand PFH*** Risk reduction factor 4 ≥10-5 to <10-4 ≥10-9 to <10-8 10 000 to 100 000 3 ≥10-4 to <10-3 ≥10-8 to <10-7 1 000 to 10 000 2 ≥10-3 to <10-2 ≥10-7 to <10-6 100 to 1 000 1 ≥10-2 to <10-1 ≥10-6 to <10-5 10 to 100 * Safety integrity level ** Probability of Failure on low Demand *** Probability of a dangerous Failure per Hour