FUNCTIONAL SAFETY MANUAL OPERATOR MANUAL Part Number: Revision: Language:

IMPORTANT INFORMATION Continued safe and reliable operation of this equipment is conditional on all installation, operation and maintenance procedures being carried out in accordance with the appropriate manuals, by personnel having appropriate qualifications, experience and training. Failure to observe the requirements of the manual may result in the user being held responsible for the consequences and may invalidate any warranty. Servomex will accept no liability for unauthorized modifications to Servomex supplied equipment. This manual should be read in conjunction with the other product manuals...

© Servomex Group Limited 2019

© Servomex Group Limited 2019

© Servomex Group Limited 2019

About this manual Safety information Sections of this manual contain supplementary installation and configuration instructions. These should always be read in conjunction with the other manuals listed below which provide more detailed instructions and contain important safety information. Scope of the manual This manual provides information and instructions that will be needed in order to use the SERVOTOUGH Oxy in safety instrumented systems. It is aimed at those responsible for planning, designing, installing, commissioning and maintaining safety instrumented systems using the SERVOTOUGH Oxy...

Introduction Product description The SERVOTOUGH Oxy is designed to provide a stable and accurate measurement of oxygen concentration using a paramagnetic transducer. It is suitable for use in hazardous areas. The sample measurement is shown on the analyzer display and is also available via digital communications and as a mA output. The analyzer also provides fault, alarm, maintenance required, service in progress and mA range change signal outputs. The analyzer can also be equipped with an optional flow alarm, pressure compensation, sample heating and auto-validation/auto-calibration functionality....

Safety information Demand Mode The safety integrity level claimed for this product is based on usage in a Low Demand mode of operation in a 1oo1 (simplex) architecture, as defined in IEC 61508 Edition 2.0 2010-01. Safety functions The SERVOTOUGH Oxy is certified suitable for use in safety instrumented systems in respect of hardware safety integrity ONLY, according to IEC 61508 Edition 2.0 201004. The usable safety functions are defined as: Safety Function 1: The indication of gas concentration by means of a 4-20mA output to the level of performance stated in the products literature. A diagnosed...

Boundary of safety system The following aspects of the are considered to be within the boundary of the safety system covered in this manual: • • • • • • • • Paramagnetic oxygen transducer Transducer heating All signal processing and support functions Power supply, distribution and intrinsic safety protection mA output Internal pressure compensation (optional) Internal flow measurement (optional) Internal sample pipe work heating (optional) Remote validation/calibration initiation and control option is explicitly excluded from the SIL 2 assessment. Data is provided to support an independent implementation...

Product configurations This manual explicitly covers the following analyzer configurations based on standard “packs” and options. Analyzer Configuration Options Entry Pack Paramagnetic oxygen transducer Transducer heating All signal processing, power and support functions mA output Relays Entry pack plus internal sample pipe work heating Pressure and Flow Pack Hot pack plus internal pressure compensation and flow sensor Complete Pack All options fitted (Excluding Auto-validation). In addition, by considering the combination of options that produces the lowest Safe Failure Fraction the manual...

Failure rate data The following section(s) contain the detailed supporting information for the various product configurations. All failures rates were predicted from an FMEDA (Failure Modes, Effects, and Diagnostics Analysis) and are stated in “failures per million hours” (fpmh). These figures may be multiplied by 1000 to obtain the failure rates in units of FIT. The PFDAVG is based on a Mean Time To Repair (MTTR) of 24 hours and a Proof Test Interval (T1) of 8760 hours (1 year). Failure data. a) Safety function 1 - This table contains the functional safety data that applies when the safety function...

b) Safety function 2 - This table contains the functional safety data that applies to the flow fault monitor via the 4-20mA output. Safety Related Characteristic Device type Hardware fault tolerance Safety integrity level Dangerous detected failure rate Dangerous undetected failure rate Safe failure rate Diagnostic coverage % Safe failure fraction Total failure rate Average probability of failure PFDAVG on demand c) Auto-validation – This table contains functional safety data for the additional hardware required for remote validation/calibration function, as it affects safety function 1. Safety...

Safety instructions General observations The must be installed and operated as detailed in the Operator Manual and product literature. Sample Gas A continuous controlled flow of clean sample gas is required. Suitable sample conditioning must be used to prevent contamination of the transducers and associated pipe work. Where the internal flow alarm is not fitted it is essential that the safety instrumented system incorporates an external device to detect loss of flow. Where the internal flow sensor is fitted, it is assumed that the composition of the sample gas is broadly the same as when it was...

Refer to the Operator manual for detail on how the auto-validation function works. Settings After installation and commissioning according to the instructions in the product manuals, the following settings MUST be set to support the safety function. Please refer to the Operator Manual for step by step instructions on these settings. Note also that a password will typically be required in this process. mA output settings Any mA output used in a safety function MUST be set to indicate an out-of-range current under fault conditions. This is achieved as follows. Set the mA output range to the 4-20mA...