E16x342 (SIL3)
4Pages

High Safety TMR Protection Systems for Rotating Equipment with SIL3 requirements Series E16x342 KEY FEATURES SIL3 / IEC 61508:2010 certified API 670 Ed.5 compliant API 612 Ed.7 compliant Total Response Time to Trip < 15 ms Useful Lifetime and Proof Test Interval = 20 years Triple speed measurement and monitoring by each Monitor Variable Overspeed setpoint depending on acceleration Direction detection Evaluation of external Trip Criteria signals by up to 6 voters per Monitor All Trip Outputs formed with safety relay contacts in 2oo3 technique Trip Output Monitoring to solenoid with Trip-Lock E16A342 System Front View E16 – The most secure TMR Protection System worldwide The BRAUN High Safety Protection System Series E16x342 is TÜV certified for SIL3 acc. IEC 61508:2010 and is API 670 Ed.5 and API 612 Ed.7 compliant. It provides protection Up to 5 additional speed setpoints in 2oo3 technique Sensor signal repeater outputs, free floating, and push/pull Remote test of solenoid trip block by test signals from DCS possible The only protection system worldwide where all relays or other active compo- nents are located on the Monitors against overspeed and detects reverse direction. Also up to six other trip criteria such as emergency stop, boiler protection, etc. can be included in the trip string. Due to its globally unique and true 2oo3 architecture, the system will tolerate one faulty signal within each trip criterion without trip being released. Maintenance-free during Lifetime, therefore minimized TCO The TMR (Triple Modular Redundancy) design ensures highest safety and availability for the monitored machine, i.e. the system will bring the machine into a safe state once it has reached a critical condition. The E16 Protection System consists of three Monitors E1667 for the evaluation of speed and external trip signals, one Test Interface E1691 and a system backplane; all mounted into a 19” rack. The E16 Protection System permanently monitors the speed sensors for their correct function. During its complete useful lifetime of 20 years, the system does not require Highest safety at maximum availability due to true 2oo3 architecture for each trip criterion within each Monitor Very low PFD value (Probability of Failure on Demand), less than 8 % of allowable value for a SIL3 loop Replacement of all active components during operation possible (hot swap and highest availability) any external proof tests. It is completely maintenance-free and therefore has minimized TCO (Total Cost of Ownership). All active components (including the trip relays) are directly located on the Monitors and thus can be replaced during operation. The protection system offers in total six 2oo3 Trip Outputs, thereof three for a solenoid trip block and three for other purposes. www.braun-tacho.

View of Monitor Main Board with incorporated trip relays. There are no relays on the backplane Mechanical Design x = A : Bulkhead Mount Version x = E : 19" Rack Mount Version 3HE/84TE x = G : NEMA 4 Version with front window (Bulkhead Mount) Examples: E16A342.021 : Bulkhead Mount Version, without Analog Output, with 6 Voters, Speed Signal Inputs for BRAUN A5S... Sensors, 1 PROFIBUS Interface per Monitor Analog Output a = 0 : without Analog Output a = 1 : 1 Analog Output in each Monitor a = 2 : 1 Analog Output certified SIL3 in each Monitor Voter b = 1 : 1 Voter (for 3 signals) in each...

Application Example (by SIEMENS Germany) Separate and independent turbine protection system (see IEC 60045-1 – Protection) Trip criteria (non-SIL and SIL) De-energizeto-trip principle Relay-DO Reset Trip Pulse signals Speed sensors (SIL3) Manual trip (Pushbuttons) External trip (DCS, boiler, etc.) Shaft monitoring system Pressure switches 1 (exhaust) Pressure switches 2 (extraction) Other criterion BRAUN Protection System E16x342 Closed Loop Control (Governor) Open Loop Control (Automatic) Non-SIL Protection Criteria Machinery Protection System (MPS) – "INTEGRATED TYPE" (see API 670 Ed.5 –...