D5072S - D5072D INSTRUCTION MANUAL. D SIL 2 Temperature Signal Converter. Multifunction, DIN-Rail and Termination Board Models D5072S, D5072D

Transcription

1 D50S INSTRUCTION MANUAL SIL Temperature Signal Converter Multifunction, DINRail and Termination Board Models D50S, D50 SIL Temperature Signal Converter G.M. International ISM050

2 Characteristics General Description: The single and dual channel Temperature Signal Converter D50S and accepts a low level dc signal from millivolt, thermocouple or resistance/rtd or transmitting potentiometer sensor, located in Hazardous Area, and converts, with isolation, the signal to drive a Safe Area load, suitable for applications requiring SIL level (according to IEC 65) in safety related systems for high risk industries. Output signal can be direct or reverse. Modbus RTU RS45 output is available on Bus connector. Cold junction compensation can be programmed as: Automatic: provided by an internal temperature sensor; Fixed: to a usercustomizable temperature value; External: making use of an external RTD; Remote: (only ) connecting compensation RTD to one of the two channels. For module: duplicator function provides two independent outputs from one single input. Output function can be configured as: average, subtractor, low/high or redundancy selector. Modules are provided with alarm function, which is available via solid state contact output, Termination Board and Power Bus. Mounting on standard DINRail, with or without Power Bus, or on customized Termination Boards, in Safe Area / Non Hazardous Location or in Zone / Class I, Division or Class I, Zone. Technical Data Supply: 4 Vdc nom ( to 30 Vdc) reverse polarity protected, ripple within voltage limits 5 Vpp, A time lag fuse internally protected. Current 4 V: 50 (), 35 (D50S) with 0 out typical. Power 4 V:.0 W (), 0.5 W (D50S) with 0 out typical. Isolation (Test Voltage): I.S. In/Out.5 KV; I.S. In/Supply.5 KV; I.S. In/I.S. In 500 V; Out/Supply 500 V; Out/Out 500 V. Input: See section Input specifications for more details on Input sensors. 4wire RTD input only on D50S. Possibility of configuring user customized sensor (TC or RTD). Choice between C/ F. Integration time: from 50 ms to 500 ms depending on sensor and fast/slow integration. Resolution: µv on mv/tc, mω on RTD/resistance, % on transmitting pot. Visualization: 0. C on temp.,0 µv on mv, 0 mω on resistance, 0. % on pot. Input range: within sensor limits (500 to 500 mv for mv, 04 kω for resistance). Measuring RTD current: 0.5. wire RTD line resistance compensation: 50 Ω (programmable). Thermocouple Reference Junction Compensation: programmable as automatic with internal compensator, fixed ( 60 to 00 C), external with any supported RTD, or remote using channel (). Thermocouple burnout current: 50 µa. Fault: enabled or disabled. Analog output can be programmed to reflect fault conditions via downscale, highscale or customized value forcing. Fault conditions are also signaled via BUS and by red LED on front panel for each channel. Fault conditions are: Sensor burnout, Sensor out of range, Output saturation, Internal fault, Cable resistance fault. Output: Fully customizable 0/4 to 0, on max. 300 Ω load source mode, current limited at 4. In sink mode, external voltage generator range is V min. 3.5V at 0Ω load and V max. 30V. If generator voltage Vg > 0 V, a series resistance (Vg 0)/0.04 Ω is needed. The maximum value of series resistance is (Vg 3.5)/0.04 Ω. Resolution: µa current output. Transfer characteristic: linear, direct or reverse on all input sensors. Response time: 0 ms (0 to 0 % step). Output ripple: 0 mvrms on 50 Ω load. Damping factor: 30 s, configurable. Modbus Output: Modbus RTU protocol, from 400 to 5.00 bps. Alarm: Trip point range: within rated limits of input sensor (see input step resolution). ONOFF delay time: 0 to 000 s, 00 ms step. Hysteresis: within rated limits of input sensor. Output: voltage free SPST photomos: 00, 60 Vdc ( V voltage drop). Performance: Ref. Conditions 4 V supply, 50 Ω load, 3 ± C ambient temperature, slow integration mode, 4wires (for D50S) or 3wires (for ) configuration for RTD. Input: Calibration and linearity accuracy: see section Input Specifications. Temperature influence: see section Input Specifications. Ref. Junction Compensation influence: ± C (internal PT000 sensor). Analog Output: Calibration accuracy: ±0.05 % of full scale. Linearity error: ±0.05 % of full scale. Supply voltage influence: ±0.0 % of full scale for a min to max supply change. Load influence: ±0.0 % of full scale for a 0 to 00 % load resistance change. Temperature influence: ±µa for a C change. Compatibility: CE mark compliant, conforms to Directive: 04/34/EU ATEX, 04/30/EU EMC, 04/35/EU LVD, 0/65/EU RoHS. Environmental conditions: Operating: temperature limits 40 to 0 C, relative humidity 5 %, up to 55 C. Storage: temperature limits 45 to 0 C. Safety Description: ATEX: II 3()G Ex na [ia Ga] IIC T4 Gc, II ()D [Ex ia Da] IIIC, I (M) [Ex ia Ma] I IECEx / INMETRO / NEPSI: Ex na [ia Ga] IIC T4 Gc, [Ex ia Da] IIIC, [Ex ia Ma] I, FM: NIAIS / I / / ABCD / T4, AIS / I,II,III / / ABCDEFG, I / / AEx na [ia] / IIC / T4 FMC: NIAIS / I / / ABCD / T4, AIS / I,II,III / / ABCDEFG, I / / Ex na [ia] / IIC / T4 EACEX: Ex na [ia Ga] IIC T4 Gc X, [Ex ia Da] IIIC, [Ex ia Ma] I. UKR TR n. : ExnAiaIICT4 X, ExiaI X associated apparatus and nonsparking electrical equipment. D50S: Uo/Voc. V, Io/Isc 3, Po/Po 40 mw, Ui/Vmax. V, Ci 0 nf, Li 0 nh at terminals 0. : Uo/Voc. V, Io/Isc 6, Po/Po mw, Ui/Vmax. V, Ci 0 nf, Li 0 nh at terminals, 0. Um 50 Vrms or Vdc, 40 C Ta 0 C. Approvals: BVS ATEX E 053 X conforms to EN6000, EN600, EN6005. IECEx BVS.0050X conforms to IEC6000, IEC600, IEC6005. INMETRO DNV 3.00 X conforms to ABNT NBR IEC6000, ABNT NBR IEC600, ABNT NBR IEC6005, ABNT NBR IEC6006. FM and FMC C conforms to Class 3600, 360, 36, 30, ANSI/ISA6000, ANSI/ISA600, ANSI/ISA6005, C. No.4, C. No.5, C. No.3, C. No. 6000, C. No. 600, C. No CIT.MH6.B.04 conforms to GOST R IEC 6000,GOST R IEC 600, GOST R IEC CЦ X conforms to ДСТУ 3, ГОСТ.5, ДСТУ IЕС GYJ4.406X conforms to GB336., GB336.4; GB336., GB TC3 for TIIS approval (only for ). TUV Certificate No. CIS360, SIL according to IEC 65. DNV Type Approval Certificate No.A365 and KR No.MIL06EL00 Certificates for maritime applications. Mounting: EN/IEC605 TH 35 DINRail, with or without Power Bus or on customized Termination Board. Weight: about 35 g, 30 g D50S. Connection: by polarized plugin disconnect screw terminal blocks to accommodate terminations up to.5 mm. Location: installation in Safe Area/Non Hazardous Locations or Zone, Group IIC T4 or Class I, Division, Group A,B,C,D, T4 or Class I, Zone, Group IIC, T4. Protection class: IP 0. Dimensions: Width.5 mm, Depth 3 mm, Height 0 mm. Programming The module is fully programmable. Operating parameters can be changed from PC via PPC50 adapter connected to USB serial line and SWC500 software. Measured values and diagnostic alarms can be read on both serial configuration or Modbus output line. SWC500 software also allows the Monitoring and Recording of values. For details please see SWC500 manual ISM054. D50 SIL Temperature Signal Converter G.M. International ISM050

3 Model: D50 channel S channels D Ordering Information Power Bus and DINRail accessories: Connector JDFT04 Terminal block male MOR0 Front Panel and Features Cover and fix MCHP6 Terminal block female MOR CONFIG PWR FLT FLT / ALR SIL D50 0 SIL according to IEC65 for Tproof3/0yrs ( 0% / >0 % of total SIF), SFF.% PFDavg ( year) 3.6 E04, with analog current output. Input from Zone 0 (Zone 0) / Division, installation in Zone / Division. mv, thermocouple, or 3 or 4 wire resistance/rtd or transmitting potentiometer Input Signal. wire RTD line resistance compensation. Internal Reference Junction Compensation. Fastest integration time: 50 ms Fully customizable Output range from 0 to 4 Output Signal linear or reverse (typical 0/40 ). Output duplication possible for. Modbus RTU RS45 Output. Independent multiple Fault detection. Programmable alarm available on solid state contact output or Termination Board connector. High Accuracy, µp controlled A/D converter. Three port isolation, Input/Output/Supply. EMC Compatibility to EN60006, EN600064, EN636, EN6363 for safety system. Fully programmable operating parameters. ATEX, IECEx, FM, FMC, INMETRO, EACEX, UKR TR n., NEPSI, TIIS, TÜV Certifications. Type Approval Certificate DNV and KR for maritime applications. High Density, two channels per unit. Simplified installation using standard DINRail and plugin terminal blocks, with or without Power Bus, or customized Termination Boards. 50 Vrms or Vdc (Um) max. voltage allowed to the instruments associated with the barrier. Data logging and monitoring via software. Terminal block connections HAZARDOUS AREA SAFE AREA D50S: Input for thermocouple TC or for 3, 4 wire RTD or potentiometer : Input for thermocouple TC or for 3 wire RTD or potentiometer D50S, (): Output (source current mode) or Output (sink current mode) D50S: Input for thermocouple TC or for, 3, 4 wire RTD or potentiometer : Input for thermocouple TC or for, 3 wire RTD or potentiometer D50S, (): Output (source current mode) or Output (sink current mode) D50S: Input for, 3, 4 wire RTD or potentiometer : Input for, 3 wire RTD or potentiometer 3 D50S (Alarm), (Current/Alarm): Output Ch (source current) or Output Ch (sink current) or Output (Alarm/Fault) 0 D50S: Input for 4 wire RTD : Input Ch for, 3 wire RTD or potentiometer 4 D50S (Alarm), (Current/Alarm): Output Ch (source current) or Output Ch (sink current) or Output (Alarm/Fault) : Input Ch for thermocouple TC or for 3 wire RTD or potentiometer 5 Power Supply 4 Vdc : Input Ch for thermocouple TC or for, 3 wire RTD or potentiometer 6 Power Supply 4 Vdc G.M. International ISM050 D50 SIL Temperature Signal Converter 3

4 Parameters Table In the system safety analysis, always check the Hazardous Area/Hazardous Locations devices to conform with the related system documentation, if the device is Intrinsically Safe check its suitability for the Hazardous Area/Hazardous Locations and group encountered and that its maximum allowable voltage, current, power (Ui/Vmax, Ii/Imax, Pi/Pi) are not exceeded by the safety parameters (Uo/Voc, Io/Isc, Po/Po) of the D50 series Associated Apparatus connected to it. Also consider the maximum operating temperature of the field device, check that added connecting cable and field device capacitance and inductance do not exceed the limits (Co/Ca, Lo/La, Lo/Ro) given in the Associated Apparatus parameters for the effective group. See parameters indicated in the table below: D50 Terminals D50 Associated Apparatus Parameters Must be Hazardous Area/ Hazardous Locations Device Parameters D50S 0 Ch 0 Uo / Voc. V Ui / Vmax D50S 0 Ch 0 Io / Isc 3 Io / Isc 6 Ii/ Imax D50S 0 Ch 0 Po / Po 40 mw Po / Po mw Pi / Pi D50 Terminals D50 Associated Apparatus Parameters Cenelec (US) Must be Hazardous Area/ Hazardous Locations Device Cable Parameters D50S 0 Ch 0 Co / Ca 3.5 µf Co / Ca 40 µf Co / Ca 000 µf Co / Ca 000 µf Co / Ca 40 µf Co / Ca 3.5 µf Co / Ca 40 µf Co / Ca 000 µf Co / Ca 000 µf Co / Ca 40 µf IIC (A, B) IIB (C) IIA (D) I IIIC (E, F, G) IIC (A, B) IIB (C) IIA (D) I IIIC (E, F, G) Ci / Ci device C cable D50S 0 Ch 0 Lo / La 6 mh Lo / La 6 mh Lo / La 53 mh Lo / La mh Lo / La 6 mh Lo / La 3 mh Lo / La 555 mh Lo / La mh Lo / La mh Lo / La 555 mh IIC (A, B) IIB (C) IIA (D) I IIIC (E, F, G) IIC (A, B) IIB (C) IIA (D) I IIIC (E, F, G) Li / Li device L cable D50S 0 Ch 0 Lo / Ro 5 µh/ω Lo / Ro 3500 µh/ω Lo / Ro 000 µh/ω Lo / Ro 40 µh/ω Lo / Ro 3500 µh/ω IIC (A, B) IIB (C) IIA (D) I IIIC (E, F, G) Lo / Ro 0 µh/ω IIC (A, B) Lo / Ro 560 µh/ω IIB (C) Lo / Ro 0330 µh/ω IIA (D) Lo / Ro 650 µh/ω I Lo / Ro 560 µh/ω IIIC (E, F, G) Li / Ri device and L cable / R cable 4 D50 SIL Temperature Signal Converter G.M. International ISM050

5 When used with separately powered intrinsically safe devices, check that maximum allowable voltage, current (Ui/Vmax, Ii/Imax) of the D50 Associated Apparatus are not exceeded by the safety parameters (Uo/Voc, Io/Isc) of the Intrinsically Safe device, indicated in the table below: D50S D50S D50 Terminals 0 Ch 0 0 Ch 0 D50 Associated Apparatus Parameters Ui / Vmax. V Ci 0 nf, Li 0 nh For installations in which both the Ci and Li of the Intrinsically Safe apparatus exceed % of the Co and Lo parameters of the Associated Apparatus (excluding the cable), then 50 % of Co and Lo parameters are applicable and shall not be exceeded (50 % of the Co and Lo become the limits which must include the cable such that Ci device C cable 50 % of Co and Li device L cable 50 % of Lo). The reduced capacitance of the external circuit (including cable) shall not be greater than μf for Groups I, IIA, IIB and 600 nf for Group IIC. If the cable parameters are unknown, the following value may be used: Capacitance 00 pf per meter (60 pf per foot), Inductance µh per meter (0.0 µh per foot). Must be Hazardous Area/ Hazardous Locations Device Parameters Uo / Voc Function Diagram HAZARDOUS AREA ZONE 0 (ZONE 0) GROUP IIC, HAZARDOUS LOCATIONS CLASS I, DIVISION, GROUPS A, B, C, D, CLASS II, DIVISION, GROUPS E, F, G, CLASS III, DIVISION, CLASS I, ZONE 0, GROUP IIC SAFE AREA, ZONE GROUP IIC T4, NON HAZARDOUS LOCATIONS, CLASS I, DIVISION, GROUPS A, B, C, D TCode T4, CLASS I, ZONE, GROUP IIC T4 TC ext. comp. TC ext. comp. In TC / mv TC / mv 3 wires RTD / Resistance 3 wires RTD / Resistance 0 MODEL Modbus RS Supply 4 Vdc Out (SIL ) Source I Sink I Source I Sink I 3 4 Out (SIL ) In B A F Termination Modbus RS45 Power and board Fault Bus connector MODEL (Alarm / Fault) TC ext. comp. In TC / mv 3 wires RTD / Resistance 5 Supply 4 Vdc 6 Source I Sink I Out A (SIL ) 3 4 Alarm / Fault Out B (SIL ) Modbus RS45 B A F Termination Modbus RS45 Power and board Fault Bus connector G.M. International ISM050 D50 SIL Temperature Signal Converter 5

6 HAZARDOUS AREA ZONE 0 (ZONE 0) GROUP IIC, HAZARDOUS LOCATIONS CLASS I, DIVISION, GROUPS A, B, C, D, CLASS II, DIVISION, GROUPS E, F, G, CLASS III, DIVISION, CLASS I, ZONE 0, GROUP IIC Function Diagram SAFE AREA, ZONE GROUP IIC T4, NON HAZARDOUS LOCATIONS, CLASS I, DIVISION, GROUPS A, B, C, D TCode T4, CLASS I, ZONE, GROUP IIC T4 MODEL (Duplicator) TC ext. comp. In TC / mv 3 wires RTD / Resistance Modbus RS Supply 4 Vdc Source I Sink I Out A (SIL ) Source I Sink I 3 4 Out B (SIL ) B A F Termination Modbus RS45 Power and board Fault Bus connector MODEL (with optional remote CJC) TC In RTD for Cold Junction Compensation Copper wire Copper wire 0 Modbus RS Supply 4 Vdc Source I Sink I Out (SIL ) Source I Sink I 3 4 Out (SIL ) In B A F Termination Modbus RS45 Power and board Fault Bus connector MODEL D50S TC ext. comp. TC / mv In 34 wires RTD / Resistance 0 5 Supply 4 Vdc 6 Source I Sink I Out A (SIL ) 3 Alarm / Fault Out B 4 Modbus RS45 B A F Termination Modbus RS45 Power and board Fault Bus connector 6 D50 SIL Temperature Signal Converter G.M. International ISM050

7 Functional Safety Manual and Application Application for D50S, with 40 Current Output Supply 4 Vdc 4 wire RTD 3 wire RTD wire RTD 5 6 Current Current Source Sink In TC 0 Channel D50S Safety PLC Out A 3 4 Alarm/Fault Out B Not for Safety purpose Description: For this application, enable 4 0 Source or Sink mode (see page for more information). The module is powered by connecting 4 Vdc power supply to Pins 5 ( positive) and 6 ( negative). The green LED is lit in presence of supply power. Input sensor (Thermocouple, RTD, Potentiometer) is applied from Pins to 0 (see page for more information about input settings). Source or Sink output current is applied to Pins. Alarm/Fault Output is only used for service purpose (not for Safety purpose) and is applied to Pins 34 Safety Function and Failure behavior: D50S is considered to be operating in Low Demand mode, as a Type B module, having Hardware Fault Tolerance (HFT) 0. The failure behaviour of D50S module (only the 4 0 current output configuration is used for safety applications) is described from the following definitions : FailSafe State: is defined as the output going to Fail Low or Fail High, considering that the Safety logic solver can convert the Low and High failures (dangerous detected failures) to the FailSafe state. Fail Safe: failure mode that causes the module / (sub)system to go to the defined FailSafe state without a demand from the process. Fail Dangerous: failure mode that does not respond to a demand from the process (i.e. being unable to go to the defined FailSafe state) or deviates the output current by more than 3% of the correct value. Fail High: failure mode that causes the output signal to go above the maximum output current (> 0 ). This limit value can be programmed by the user, but in this analysis it is set to 0. Assuming that the application program in the Safety logic solver is configured to detect High failures and does not automatically trip on these failures, they have been classified as Dangerous Detected (DD) failures. Fail Low: failure mode that causes the output signal to go below the minimum output current (< 4 ). This limit value can be programmed by the user, but in this analysis it is set to 4. Assuming that the application program in the Safety logic solver is configured to detect Low failures and does not automatically trip on these failures, they have been classified as Dangerous Detected (DD) failures. Fail No Effect : failure mode of a component that plays a part in implementing the Safety Function but that is neither a safe failure nor a dangerous failure. When calculating the SFF, this failure mode is not taken into account. Fail Not part : failure mode of a component which is not part of the Safety Function but is part of the circuit diagram and is listed for completeness. When calculating the SFF this failure mode is not taken into account. As the module is supposed to be proveninuse device, therefore according to the requirements of IEC 65 section.4.4, a HFT 0 is sufficient for SIL (sub) systems in Failure rate table: Failure category Failure rates (FIT) λdd Total Dangerous Detected failures 40.6 λdu Total Dangerous Undetected failures.43 λsd Total Safe Detected failures 0.00 λsu Total Safe Undetected failures 0.00 λtot safe Total Failure Rate (Safety Function) λdd λdu λsd λsu 3.6 MTBF (safety function, single channel) ( / λtot safe) MTTR ( hours) 366 years λno effect No Effect failures 0.3 λnot part Not Part failures 4.30 λtot device Total Failure Rate (Device) λtot safe λno effect λnot part MTBF (device, single channel) ( / λtot device) MTTR ( hours) years Failure rates table according to IEC 650:00 Ed. : λsd λsu λdd λdu SFF DCD 0.00 FIT 0.00 FIT 40.6 FIT.43 FIT.0%.0% where DC means the diagnostic coverage (safe or dangerous) for the input sensor by the safety logic solver and internal diagnostic circuits. This type B system has SFF.0 % 60 % and HFT 0, which is sufficient to get SIL in accordance with the requirements of IEC 65 section.4.4 during a proveninuse assessment. PFDavg vs T[Proof] table (assuming Proof Test coverage of %), with determination of SIL supposing module contributes 0% of total SIF dangerous failures: T[Proof] year T[Proof] 3 years T[Proof] 0 years PFDavg 3.5E04 Valid for SIL PFDavg.46E04 Valid for SIL PFDavg 6.3E03 Valid for SIL PFDavg vs T[Proof] table (assuming Proof Test coverage of %), with determination of SIL supposing module contributes >0% of total SIF dangerous failures: T[Proof] 0 years PFDavg 3.5E03 Valid for SIL G.M. International ISM050 D50 SIL Temperature Signal Converter

8 Functional Safety Manual and Application Application for, with 40 Current Output In TC 3 wire RTD wire RTD Supply 4 Vdc 5 6 Channel Current Source Safety PLC Current Sink Out In TC 3 wire RTD wire RTD 0 Channel 3 4 Current Source Safety PLC Current Sink Out Description: For this application, enable 4 0 Source or Sink mode for ch. and ch. (see page for more information). The module is powered by connecting 4 Vdc power supply to Pins 5 ( positive) and 6 ( negative). The green LED is lit in presence of supply power. Input sensor (Thermocouple, RTD, Potentiometer) is applied from Pins to (for ch. ) and from Pins 0 to (for ch. ). See page for more information about input settings. Source or Sink output current is applied to Pins (for ch. ) and to Pins 3 4 (for ch. ). Safety Function and Failure behavior: is considered to be operating in Low Demand mode, as a Type B module, having Hardware Fault Tolerance (HFT) 0. The failure behaviour of module (only the 4 0 current output configuration is used for safety applications) is described from the following definitions : FailSafe State: is defined as the output going to Fail Low or Fail High, considering that the Safety logic solver can convert the Low and High failures (dangerous detected failures) to the FailSafe state. Fail Safe: failure mode that causes the module / (sub)system to go to the defined FailSafe state without a demand from the process. Fail Dangerous: failure mode that does not respond to a demand from the process (i.e. being unable to go to the defined FailSafe state) or deviates the output current by more than 3% of the correct value. Fail High: failure mode that causes the output signal to go above the maximum output current (> 0 ). This limit value can be programmed by the user, but in this analysis it is set to 0. Assuming that the application program in the Safety logic solver is configured to detect High failures and does not automatically trip on these failures, they have been classified as Dangerous Detected (DD) failures. Fail Low: failure mode that causes the output signal to go below the minimum output current (< 4 ). This limit value can be programmed by the user, but in this analysis it is set to 4. Assuming that the application program in the Safety logic solver is configured to detect Low failures and does not automatically trip on these failures, they have been classified as Dangerous Detected (DD) failures. Fail No Effect : failure mode of a component that plays a part in implementing the Safety Function but that is neither a safe failure nor a dangerous failure. When calculating the SFF, this failure mode is not taken into account. Fail Not part : failure mode of a component which is not part of the Safety Function but is part of the circuit diagram and is listed for completeness. When calculating the SFF this failure mode is not taken into account. As the module is supposed to be proveninuse device, therefore according to the requirements of IEC 65 section.4.4, a HFT 0 is sufficient for SIL (sub) systems including Type B components and having a SFF equal or more than 60%. Failure rate table: Failure category Failure rates (FIT) λdd Total Dangerous Detected failures 3.5 λdu Total Dangerous Undetected failures.43 λsd Total Safe Detected failures 0.00 λsu Total Safe Undetected failures 0.00 λtot safe Total Failure Rate (Safety Function) λdd λdu λsd λsu MTBF (safety function, one channel) ( / λtot safe) MTTR ( hours) 3 years λno effect No Effect failures.05 λnot part Not Part failures.0 λtot device Total Failure Rate (Device) λtot safe λno effect λnot part 5.0 MTBF (device) ( / λtot device) MTTR ( hours) 3 years Failure rates table according to IEC 650:00 Ed. : λsd λsu λdd λdu SFF DCD 0.00 FIT 0.00 FIT 3.5 FIT.43 FIT.%.% where DC means the diagnostic coverage (safe or dangerous) for the input sensor by the safety logic solver and internal diagnostic circuits. This type B system has SFF. % 60 % and HFT 0, which is sufficient to get SIL in accordance with the requirements of IEC 65 section.4.4 during a proveninuse assessment. PFDavg vs T[Proof] table (assuming Proof Test coverage of %), with determination of SIL supposing module contributes 0% of total SIF dangerous failures: T[Proof] year T[Proof] 3 years T[Proof] 0 years PFDavg 3.6E04 Valid for SIL PFDavg.4E04 Valid for SIL PFDavg 6.3E03 Valid for SIL PFDavg vs T[Proof] table (assuming Proof Test coverage of %), with determination of SIL supposing module contributes >0% of total SIF dangerous failures: T[Proof] 0 years PFDavg 3.6E03 Valid for SIL D50 SIL Temperature Signal Converter G.M. International ISM050

9 Testing procedure at Tproof The proof test shall be performed to reveal dangerous faults which are undetected by diagnostic. This means that it is necessary to specify how dangerous undetected faults, which have been noted during the FMEDA, can be revealed during the proof test. Proof test (to reveal 50 % of possible Dangerous Undetected failures) Steps Action Bypass the Safety PLC or take any other appropriate action to avoid a false trip. Send a command to the temperature converter to go to the full scale current output and verify that the analog current reaches that value. This tests is for voltage compliance problems, such as low supply voltage or increased wiring resistance, and for other possible failures. 3 Send a command to the temperature converter to go to the low scale current output and verify that the analog current reaches that value. This tests is for possible quiescent current related failures. 4 Restore the loop to full operation. 5 Remove the bypass from the Safetyrelated PLC or restore normal operation. Proof test (to reveal % of possible Dangerous Undetected failures) Steps Action Bypass the Safety PLC or take any other appropriate action to avoid a false trip. Perform steps and 3 of Proof Test. 3 Perform a twopoint calibration of the temperature converter (i.e. 4 and 0 ) and verify that the module output current is within the specified accuracy. 4 Restore the loop to full operation. 5 Remove the bypass from the Safetyrelated PLC or restore normal operation. Warning D50 series are isolated Intrinsically Safe Associated Apparatus installed into standard EN/IEC605 TH 35 DINRail located in Safe Area or Zone, Group IIC, Temperature T4 Hazardous Area (according to EN/IEC6005) within the specified operating temperature limits Tamb 40 to 0 C, and connected to equipment with a maximum limit for AC power supply Um of 50 Vrms or Vdc. Not to be connected to control equipment that uses or generates more than 50 Vrms or Vdc with respect to earth ground. D50 series must be installed, operated and maintained only by qualified personnel, in accordance to the relevant national/international installation standards (e.g. EN/IEC6004 Electrical apparatus for explosive gas atmospheres Part 4: Electrical installations in hazardous areas (other than mines)), following the established installation rules, particular care shall be given to segregation and clear identification of I.S. conductors from non I.S. ones. Deenergize power source (turn off power supply voltage) before plug or unplug the terminal blocks when installed in Hazardous Area or unless area is known to be nonhazardous. Warning: substitution of components may impair Intrinsic Safety and suitability for Zone. Explosion Hazard: to prevent ignition of flammable or combustible atmospheres, disconnect power before servicing or unless area is known to be nonhazardous. Failure to properly installation or use of the equipment may risk to damage the unit or severe personal injury. The unit cannot be repaired by the end user and must be returned to the manufacturer or his authorized representative. Any unauthorized modification must be avoided. Operation Each input channel of Temperature Signal Converter D50 accepts a low level dc signal from millivolt, thermocouple or 34 wire RTD temperature or transmitting potentiometer sensor, located in Hazardous Area, and converts, with isolation, the signal to a 40 floating output current to drive a Safe Area load. Presence of supply power is displayed by a POWER ON green signaling LED; integrity of field sensor and connecting line can be monitored by a configurable burnout circuit which, if enabled, can drive output signal to upscale or downscale limit. Burnout condition is signaled by red front panel LED for each channel. module has double input and output channel, and can also be programmed to interface a single input and obtain dual output channel (duplicator) or configurable output channel (outputs can repeat the corresponding inputs or be proportional to the sum or difference of the two input process variables or with low/high selector function). Installation D50 series are Temperature Signal Converter housed in a plastic enclosure suitable for installation on EN/IEC605 TH 35 DINRail, with or without Power Bus or on customized Termination Board. D50 unit can be mounted with any orientation over the entire ambient temperature range. Electrical connection of conductors up to.5 mm² are accommodated by polarized plugin removable screw terminal blocks which can be plugged in/out into a powered unit without suffering or causing any damage (for Zone installations check the area to be nonhazardous before servicing). Connect only one individual conductor per each clamping point, use conductors up to.5 mm and a torque value of Nm. Use only cables that are suitable for a temperature of at least 5 C. The wiring cables have to be proportionate in base to the current and the length of the cable. On the section Function Diagram and enclosure side a block diagram identifies all connections. Intrinsically Safe conductors must be identified and segregated from non I.S. and wired in accordance to the relevant national/international installation standards (e.g. EN/IEC6004 Electrical apparatus for explosive gas atmospheres Part 4: Electrical installations in hazardous areas (other than mines)), make sure that conductors are well isolated from each other and do not produce any unintentional connection. Connect alarm transistors checking the load rating to be within the maximum rating (00 at 60 Vdc ( V voltage drop)). The enclosure provides, according to EN605, an IP0 minimum degree of protection (or similar to NEMA Standard 50 type ). The unit shall be installed in an area of not more than pollution degree according to EN/IEC For hazardous location, the unit shall be installed in a certified Ex enclosure with a minimum ingress protection of at least IP54 in accordance with EN/IEC6005, that must have a door or cover accessible only by the use of a tool. Units must be protected against dirt, dust, extreme mechanical (e.g. vibration, impact and shock) and thermal stress, and casual contacts. If enclosure needs to be cleaned use only a cloth lightly moistened by a mixture of detergent in water. Electrostatic Hazard: to avoid electrostatic hazard, the enclosure of D50 must be cleaned only with a damp or antistatic cloth. Any penetration of cleaning liquid must be avoided to prevent damage to the unit. Any unauthorized modification must be avoided. According to EN600, D50 series must be connected to SELV or SELVE supplies. All circuits connected to D50 unit must comply with the overvoltage category II (or better) according to EN/IEC Startup Before powering the unit check that all wires are properly connected, particularly supply conductors and their polarity, input and output wires, also check that Intrinsically Safe conductors and cable trays are segregated (no direct contacts with other non I.S. conductors) and identified either by color coding, preferably blue, or by marking. Check conductors for exposed wires that could touch each other causing dangerous unwanted shorts. Check that the module has been correctly configured through SWC500 software. For details please see SWC500 manual ISM054 Turn on power, the power on green LED must be lit, output on each channel must be in accordance with the corresponding input signal value and input/output chosen transfer function. If possible change the sensor condition and check the corresponding Safe Area output. G.M. International ISM050 D50 SIL Temperature Signal Converter

10 Input specifications: Input specifications Input Type Alpha [ C ] Nominal resistance [Ω] Standards Min Span [ C ( F)] Accuracy [ C ( F)] Accuracy Range [ C ( F)] Maximum Range [ C ( F)] Temperature Influence per C typical [ C ( F)] RTD TC Ohm mv () ±0.5 (±0.) 00 0 (36) ±0. (±0.4) IEC 605 GOST JIS C () ±0. (±0.) JIS C (36) ±0. (±0.4) Notes: RTD/resistance accuracy shown in 4wires (for D50S) or 3wires (for ) configuration, in slow acquisition mode. TC/mV Accuracy shown in slow acquisition mode. 00 to 50 (3 to 56) 00 to 630 (3 to 66) Platinum 00 to (36) ±0. (±0.4) (3 to 66) () ±0.5 (±0.) 00 0 (36) ±0. (±0.4) 00 to GOST 665 (3 to 0) () ±0. (±0.) Nickel 60 to DIN 4360 ±0. (±0.4) (6 to 356) 0 () 0 to ±0. (±0.4) ( to 500) GOST (36) ±0.3 (±0.5) 50 to 0 (5 to 356) Copper (36) ±0.3 (±0.5) 50 to 00 GOST () ±0. (±0.4) (5 to 3) (0) ±. (±3.) 00 to 60 (3 to 500) A GOST (0) ±0. (±.3) 0 to 500 (3 to 453) A GOST (0) ±0.5 (±0.) 0 to 00 (3 to 3) A3 GOST (0) ±0.5 (±0.) 0 to 00 (3 to 3) B GOST (360) ±. (±.0) C ASTM E 00 (0) ±0.6 (±.) D ASTM E 00 (0) ±0.6 (±.) E GOST (0) ±0. (±0.4) J GOST (0) ±0. (±0.4) K GOST (0) ±0.3 (±0.5) L (type L DIN) DIN (0) ±0. (±0.4) LR (type L GOST) GOST (0) ±0.3 (±0.5) N GOST (0) ±0.4 (±0.) R GOST (0) ±0. (±.4) S GOST (0) ±0. (±.4) T GOST (0) ±0. (±0.4) U DIN (0) ±0.4 (±0.) 450 to 0 (4 to 330) 0 to 35 (3 to 4) 0 to 35 (3 to 4) 50 to 000 (3 to 3) 50 to 00 (3 to ) 50 to 3 (3 to 50) 00 to 00 (3 to 65) 00 to 00 (3 to 4) 50 to 300 (3 to 3) 50 to 6 ( to 34) 50 to 6 ( to 34) 00 to 400 (4 to 5) 00 to 50 (3 to 56) 00 to 630 (3 to 66) 00 to 630 (3 to 66) 00 to 650 (3 to 0) 60 to 0 (6 to 356) 0 to 60 ( to 500) 50 to 0 (5 to 356) 50 to 00 (5 to 3) 00 to 60 (3 to 500) 0 to 500 (3 to 453) 0 to 00 (3 to 3) 0 to 00 (3 to 3) 0 to 0 (3 to 330) 0 to 35 (3 to 4) 0 to 35 (3 to 4) 0 to 000 (454 to 3) 0 to 00 (346 to ) 0 to 3 (454 to 50) 00 to 00 (3 to 65) 00 to 00 (3 to 4) 0 to 300 (454 to 3) 50 to 6 (5 to 34) 50 to 6 (5 to 34) 0 to 400 (454 to 5) ( ±0.0) ( ±0.0) ( ±0.0) ( ±0.0) ( ±0.0) ( ±0.0) ( ±0.0) ( ±0.0) ( ±0.00) ±0.00 ( ±0.6) ( ±0.00) ( ±0.00) ±0.060 ( ±0.0) ±0.00 ( ±0.44) ±0.00 ( ±0.44) ( ±0.00) ( ±0.00) ( ±0.00) ( ±0.00) ( ±0.00) ±0.060 ( ±0.0) ±0.060 ( ±0.0) ±0.060 ( ±0.0) ±0.00 ( ±0.036) 00 to 600 (3 to ) 00 to 600 (3 to ) Type Nominal Min Span Accuracy Accuracy Range Maximum Range resistance [Ω] [Ω] [Ω] [Ω] [Ω] Resistance standard 0 to ±0. 0 to to 000 ±0.0 Resistance extended 0 to ±0.4 0 to to 4000 ±0.0 Potentiometer 00 to 0000 % ±0.% 0 to 00% 0 to 00% ±0.0% ±0.040 ( ±0.0) Temperature Influence per C typical [Ω] Type Min Span Accuracy Accuracy Range Maximum Range [mv] [µv] [mv] [mv] DC standard ±0 50 to 0 00 to 00 ±3 DC extended 0 ± to to 500 ±0 Temperature Influence per C typical [µv] 0 D50 SIL Temperature Signal Converter G.M. International ISM050

11 Supported Modbus functions: Code Name Notes 03 read holding registers reads a stream of words from memory 04 read input registers reads a stream of words from memory 0 diagnostics: subcode 0 returns query data 06 write single register writes a word in memory 6 write multiple registers writes a stream of words in memory Supported Modbus parameters: The unit can communicate via Modbus RTU RS45 protocol. Below is a list of all available registers. Each Modbus parameter is described by one 6bit word. 'Addr.' is the address of the parameter. 'Description' explains the function of the parameter. 'Rights' identifies the operation that can be executed by the user: RO (Read Only); WO (Write Only); RW (Read and Write). 'Type' indicates the kind of the variable: SINT / UINT: signed / unsigned bits integer; SINT6 / UINT6: signed / unsigned 6 bits integer; SINT3 / UINT3: signed / unsigned 3 bits integer; FLOAT: floating point single precision real; DOUBLE: floating point double precision real; the suffix '[n]' indicates an array of n elements of the corresponding type. Addr. Description Rights Type IDENTIFICATION 0 GM International code RO UINT6 Software revision RO UINT6 Product code RO UINT6 3 Option code RO UINT6 4 Hardware revision RO UINT6 COMMAND EXECUTION 00 Command (*) WO UINT6 GENERAL CONFIGURATION 0 Fault on bus mask (*) RW UINT3 MODBUS COMMUNICATION 300 Modbus address RW UINT6 30 Modbus baudrate (*3) RW UINT6 30 Modbus format (*4) RW UINT6 GENERAL DEBUG 400 Time stamp [00ms] RO UINT3 404 Cumulative faults (*) RO UINT3 TAG 00 Tag RW UINT[6] 0 Tag RW UINT[6] OUTPUT CONFIGURATION 00 Input to analog out function (*5) RW UINT6 0 Input to analog out function (*5) RW UINT6 ALARM CONFIGURATION 03 Input to alarm function (*5) RW UINT6 INPUT CONFIGURATION 04 Integration speed (*6) RW UINT6 00 : sensor family (*) RW UINT6 0 : sensor connection (*) RW UINT6 0 : sensor type (*) RW UINT6 03 : sensor burnout configuration (*0) RW UINT6 04 : cold junction compensation (*) RW UINT6 05 : cold junction external type (*) RW UINT6 000 Ch: sensor family (*) RW UINT6 00 Ch: sensor connection (*) RW UINT6 00 Ch: sensor type (*) RW UINT6 003 Ch: sensor burnout configuration (*0) RW UINT6 004 Ch: cold junction compensation (*) RW UINT6 005 Ch: cold junction external type (*) RW UINT6 00 : cold junction fixed value [0. C] RW SINT3 0 : wire rtd correction [mohm] RW SINT3 04 : rtd multiplier RW FLOAT 00 Ch: cold junction fixed value [0. C] RW SINT3 0 Ch: wire rtd correction [mohm] RW SINT3 04 Ch: rtd multiplier RW FLOAT MEASURE 500 : sensor value (volt, res, ratio) [uv, mohm, ppm] RO SINT3 50 : cold junction resistance value [mohm] RO SINT3 504 : sensor temperature [0. C] RO SINT3 506 : cold junction temperature [0. C] RO SINT3 600 Ch: sensor value (volt, res, ratio) [uv, mohm, ppm] RO SINT3 Addr. Description Rights Type 60 Ch: cold junction resistance value [mohm] RO SINT3 604 Ch: sensor temperature [0. C] RO SINT3 606 Ch: cold junction temperature [0. C] RO SINT3 OUTPUT CONFIGURATION 00 : output downscale [00nA] RW SINT3 0 : output upscale [00nA] RW SINT3 04 : output underrange [00nA] RW SINT3 06 : output overrange [00nA] RW SINT3 0 : output in case of fault [00nA] RW SINT3 0 : output fault mask (*) RW UINT3 6 : output damping factor [s] RW UINT3 : input downscale [uv, mohm, ppm] RW SINT3 0 : input upscale [uv, mohm, ppm] RW SINT3 000 Ch: output downscale [00nA] RW SINT3 00 Ch: output upscale [00nA] RW SINT3 004 Ch: output underrange [00nA] RW SINT3 006 Ch: output overrange [00nA] RW SINT3 00 Ch: output in case of fault [00nA] RW SINT3 00 Ch: output fault mask (*) RW UINT3 06 Ch: output damping factor [s] RW UINT3 0 Ch: input downscale [uv, mohm, ppm] RW SINT3 00 Ch: input upscale [uv, mohm, ppm] RW SINT3 OUTPUT DEBUG 30 : output virtual value [00nA] RO SINT3 40 Ch: output virtual value [00nA] RO SINT3 ALARM CONFIGURATION 600 Ch: alarm configuration (*3) RW UINT3 604 Ch: alarm start lock (*4) RW UINT3 606 Ch: contact position in case of alarm (*5) RW UINT3 60 Ch: alarm fault configuration (*6) RW UINT3 60 Ch: alarm fault mask (*) RW UINT3 6 Ch: delay to alarm issue [ms] RW UINT3 64 Ch: delay to alarm removal [ms] RW UINT3 66 Ch: alarm low threshold [uv, mohm, ppm] RW SINT3 6 Ch: alarm low threshold hysteresis [uv, mohm, ppm] RW SINT3 60 Ch: alarm high threshold [uv, mohm, ppm] RW SINT3 6 Ch: alarm high threshold hysteresis [uv, mohm, ppm] RW SINT3 ALARM DEBUG 06 Ch: alarm virtual state (*) RO UINT3 OUTPUT CONFIGURATION 00 : output drive (*) RW UINT Ch: output drive (*) RW UINT6 INPUT CONFIGURATION 300 Callendarvan dusen coeff. A [/ C] RW FLOAT 30 Callendarvan dusen coeff. B [/ C] RW FLOAT 304 Callendarvan dusen coeff. C [/ C4] RW FLOAT 306 Callendarvan dusen res. at 0 C [mohm] RW UINT3 30 Table minimum temperature [0. C] RW SINT3 30 Table maximum temperature [0. C] RW SINT3 300 Sensor family (*) RW UINT3 30 Table minimum temperature [0. C] RW SINT3 304 Table maximum temperature [0. C] RW SINT3 306 Table temperature step [0. C] RW UINT3 30 Custom sensor table [uv, mohm] RW SINT3[00] G.M. International ISM050 D50 SIL Temperature Signal Converter

12 Modbus parameters details: * Command List full eeprom write * Fault Mask no internal/hardware fault internal/hardware fault.. 0 no configuration fault configuration fault.. 0 no input open/burnout input open/burnout no input open/burnout input open/burnout no input cold junction input cold junction no input cold junction input cold junction no input cable resistance input cable resistance.. 0 no input cable resistance input cable resistance.. 0 no input out of spec input out of spec.. 0 no input out of spec input out of spec no analog out saturation analog out saturation.. 0 no analog out saturation analog out saturation *3 Modbus Baudrate baud rate 400 bit/s baud rate 600 bit/s baud rate 00 bit/s 3 baud rate 3400 bit/s 4 baud rate 5600 bit/s 5 baud rate 500 bit/s *4 Modbus Format parity none parity even parity odd.. 0 termination resistance off termination resistance on bit endianness little 3bit endianness big *5 InputtoOutput Assignment input temp input temp mean input temp (input temp input temp)/ 3 input temp input temp 4 input temp input temp 5 max(input temp, input temp) 6 min(input temp, input temp) input redundancy mean input temperature or temperature of the healthy sensor electrical measure electrical measure 0 electrical measure cj voltage (compensated sensor ) electrical measure cj voltage (compensated sensor ) *6 Integration Speed slow fast * Sensor Family thermocouple rtd voltage 3 resistance 4 potentiometer * Sensor Connection volt/tc wires tc external compensation res/rtd wires 3 res/rtd 3 wires 4 res/rtd 4 wires 5 potentiometer 3 wires * Sensor Type thermocouple A thermocouple A thermocouple A3 3 thermocouple B 4 thermocouple C 5 thermocouple D 6 thermocouple E thermocouple J thermocouple K thermocouple L 0 thermocouple LR thermocouple N thermocouple R 3 thermocouple S 4 thermocouple T 5 thermocouple U 6 Pt50 rtd (a0.0035) Pt00 rtd (a0.0035) Pt00 rtd (a0.0035) Pt300 rtd (a0.0035) 0 Pt400 rtd (a0.0035) Pt500 rtd (a0.0035) Pt000 rtd (a0.0035) 3 Pt46 rtd (a0.003) 4 Pt50 rtd (a0.003) 5 Pt00 rtd (a0.003) 6 Pt00 rtd (a0.003) Pt300 rtd (a0.003) Pt400 rtd (a0.003) Pt500 rtd (a0.003) 30 Pt00 rtd (a0.0036) 3 Pt00 rtd (a0.0036) 3 Cu53 rtd (a ) 33 Cu.035 rtd (a0.0044) 34 Cu50 rtd (a0.0040) 35 Cu00 rtd (a0.0040) 36 Ni00 rtd (a0.006) 3 Ni0 rtd (a0.0060) 3 voltage standard 3 voltage extended 40 resistance standard 4 resistance extended 4 potentiometer 43 callendar Van Dusen 44 custom sensor *0 Input Burnout Configuration input burnout active input burnout off * Cold Junction Compensation internal fixed other sensor 3 external * Cold Junction Force Command cold junction measured cold junction fixed *3 Alarm Configuration no alarm alarm low alarm high 3 alarm window 4 fault repeater *4 Alarm Lock no alarm lock alarm lock activated *5 Contact Position In Case Of Alarm open closed *6 Alarm Fault Configuration ignore fault lock alarm state before fault alarm on in case of fault 3 alarm off in case of fault * Alarm Virtual State alarm off alarm on * Output Drive output sink output source D50 SIL Temperature Signal Converter G.M. International ISM050