Archives

Assessment of Functional Safety

The design features and the techniques/measures used to prevent systematic faults are suitable for the use of

the MTLx546 and MTLx549 modules in safety functions up to SIL2 in a simplex architecture.

The hardware assessment shows that MTLx54x analogue output modules:

•  have a hardware fault tolerance of 0

•  are classified as Type A devices (“Non-complex” component with well-defined failure modes)

•  have no internal diagnostic elements

It should be recognised that the systematic capability of the products limits their application to SIL2 loops.

It is important that the effect of electromagnetic interference on the operation of any safety function is reduced

where possible. For this reason it is recommended that the cable connections from the logic solver to the isolator

modules be a maximum of 30 metres and are not exposed to possible induced surges, keeping them inside a

protected environment.

Similarly, operation of the equipment outside of its environmental ratings induces component stress and

temperature above the normal ambient of 60°C is to be avoided to ensure required performance.

Selection of product and implications

The analogue signal levels employed by the MTLx54x are within the operating range of 4-20mA under normal

conditions.

If the wiring between the isolator and field device are open circuit then the line-fault detect (LFD) operation of the

isolator forces the current taken into the input terminals to fall to a low value, which is less than the expected under

range value of 3.6mA. The MTLx546 and MTLx549 models also detect when the resistance in the field wiring is less

than fifty ohms indicating a short circuit condition, and this also is reflected into a low input current value.

This diagnostic aspect can be used by logic solvers that include a readback facility to monitor the output current from

their output cards or modules. Thus the ability to detect that the actual current being passed is not the desired value

can be used to determine the health of the instrument function. The same condition of the actual loop current falling

to a low level will also occur if the wiring between the logic solver and the isolator is open circuit.

Using a field device and logic controller, as defined in section 2. with an MTLx54x then a system-loop can be

implemented that applies functional safety together with intrinsic safety to meet the requirements of protection

against explosion hazards. Note that the transfer of HART communications through the isolator is not considered as

part of the safety function of the isolator.

It should be recognised that the systematic capability of the products limits their application to SIL2 loops.

It is important that the effect of electromagnetic interference on the operation of any safety function is reduced

where possible. For this reason it is recommended that the cable connections from the logic solver to the isolator

modules be a maximum of 30 metres and are not exposed to possible induced surges, keeping them inside a

protected environment.

Similarly, operation of the equipment outside of its environmental ratings induces component stress and

temperature above the normal ambient of 60°C is to be avoided to ensure required performance.

Associated System Components

There are many parallels between the loop components that must be assessed for intrinsic safety as well as

functional safety where in both situations the contribution of each part is considered in relation to the whole.

The MTLx54x module is a component in the signal path between safety-related actuators and safety-related

control systems.

The current to pressure converter, valve positioner, or other field device, must be suitable for the process and

have been assessed and verified for use in functional safety applications as well as its certification for hazardous

area mounting.

The safety system PLC shall have a current output with a normal operating range of 4-20mA but capable of

working over the extended range of 3 to 22mA for under- and over-range. Such controllers will normally also

include a readback facility to enable the detection of open or short circuits in the wiring.

The transmission of HART data is not considered as part of the safety function and is excluded from this analysis.

Variant Description

Functionally the MTL4500 and MTL5500 range of modules are the same but differ in the following way:

– the MTL4500 modules are designed for backplane mounted applications- the MTL5500 modules are

designed for DIN rail mounting.

In both models the hazardous area field-wiring connections (terminals 1-2. and 4-5) are made through the

removable blue connectors on the top of the modules, but the safe area and power connections for the MTL454x

modules are made through the connector on the base, while the MTL554x uses the removable grey connectors

on the top and side of the module.

Note that the safe-area connection terminal numbers differ between the backplane and DIN-rail mounting models.

The analogue output models covered by this manual are:

MTL4546 and MTL5546    single channel, open and short cct LFD

MTL4546C, MTL4546Y, and MTL5546Y    single channel, open cct LFD

MTL4549. and MTL5549    dual channel, open and short cct LFD

MTL4549C, MTL4549Y, and MTL5549Y    dual channel, open cct LFD

INTRODUCTION

Application and function

The MTL454x and MTL554x are isolator modules which enable an analogue 4/20mA control signal to be

passed to a device located in a hazardous area from a safe area. The output current available to the hazardous

area is limited to comply with the requirements of the process explosion hazard. The modules are also

designed and assessed according to IEC 61508 for use in safety instrumented systems up to SIL2 when

the required function is to repeat the loop current within ±2%, and the safe state of the output is <3.6mA

(downscale). Higher integrity levels for a SIF can be achieved by using the modules in a voting architecture.

For ‘smart’ valve positioners using the HART protocol the units allow bi-directional communications

superimposed on the 4/20mA signal current.

There are no configuration switches or operator controls to be set on the modules – they perform a fixed

function related to the model selected. The MTLx546 models are single channel while the MTLx549 models

are dual channel, although both channels must not be used in the same safety instrumented function.

These modules are members of the MTL4500 and MTL5500 range of products.