Kindly Note: For expanding further cooperation with customers, old and new, now we have MTL5544D, MTL5541 and MTL5511 barriers in stock with a special price.
If you have any need, kindly send an inquiry to us !
1 INTRODUCTION SIL
1.1 Application and function
The MTL454x and MTL554x are isolator modules which enable an analogue 4/20mA control signal to be passed to a device located in a hazardous area from a safe area. The output current available to the hazardous area is limited to comply with the requirements of the process explosion hazard. The modules are also designed and assessed according to IEC 61508 for use in safety instrumented systems up to SIL2 when the required function is to de-energise the output.
For ‘smart’ valve positioners using the HART protocol the units allow bi-directional communications superimposed on the 4/20mA signal current. .
There are no configuration switches or operator controls to be set on the modules – they perform a fixed function related to the model selected. The MTLx546 models are single channel while the MTLx549 models are dual channel, although both channels must not be used in the same safety instrumented function.
These modules are members of the MTL4500 and MTL5500 Series of products.
1.2 Variant Description
Functionally the MTL4500 and MTL5500 Series modules are the same but differ in the following way:
- the MTL4500 modules are designed for backplane mounted applications
- the MTL5500 modules are designed for DIN rail mounting.
In both models the hazardous area field-wiring connections (terminals 1-2, and 4-5) are made through the removable blue connectors on the top of the modules, but the safe area and power connections for the MTL454x modules are made through the connector on the base, while the MTL554x uses the removable grey connectors on the top and side of the module.
Note that the safe-area connection terminal numbers differ between the backplane and DIN-rail mounting models.
The analogue output models covered by this manual are:
MTL4546 and MTL5546 single channel, open and short cct LFD
MTL4546C, MTL4546Y, and MTL5546Y single channel, open cct LFD
MTL4549, and MTL5549 dual channel, open and short cct LFD
MTL4549C, MTL4549Y, and MTL5549Y dual channel, open cct LFD
Note: To avoid repetition, further use of MTLx54x in this document can be understood to include both DIN-rail and backplane models. Individual model numbers will be used only where there is a need to distinguish between them.
2 System Configuration
An MTLx54x module may be used in single-channel (1oo1) safety functions up to SIL2.
The figure below shows the system configuration and specifies detailed interfaces to the safety related and non safety-related system components. It does not aim to show all details of the internal module structure, but is intended to support understanding for the application.
The MTLx54x modules are designed to repeat the current signal from a safe-area source to a field device such as a current-topneumatic converter or valve positioner in the hazardous area. The shaded area indicates the safety relevant system connection, while the power supply connections are not safety-related. For simplicity the term ‘PLC’ has been used to denote the safety system performing the driving function of the process loop.
Note: When using the MTLx549 dual-channel modules, it is not appropriate for both channels to be used in the same loop, or the same safety function, as this creates concerns of common-cause failures. Consideration must also be made of the effect of common-cause failures when both loops of a dual-channel module are used for different safety functions.
2.1 Associated System Components
There are many parallels between the loop components that must be assessed for intrinsic safety as well as functional safety where in both situations the contribution of each part is considered in relation to the whole.
The MTLx54x module is a component in the signal path between safety-related actuators and safety-related control systems.
The current to pressure converter, valve positioner, or other field device, must be suitable for the process and have been assessed and verified for use in functional safety applications as well as its certification for hazardous area mounting.
The safety system PLC shall have a current output with a normal operating range of 4-20mA but capable of working over the extended range of 3 to 22mA for under- and over-range. Such controllers will normally also include a readback facility to enable the detection of open or short circuits in the wiring.
The transmission of HART data is not considered as part of the safety function and is excluded from this analysis.
3 Selection of product and implications
The analogue signal levels employed by the MTLx54x are within the operating range of 4-20mA under normal conditions.
If the wiring between the isolator and field device are open circuit then the line-fault detect (LFD) operation of the isolator forces the current taken into the input terminals to fall to a low value, which is less than the expected under-range value of 3.6mA. The MTLx546 and MTLx549 models also detect when the resistance in the field wiring is less than fifty ohms indicating a short circuit condition, and this also is reflected into a low input current value.
This diagnostic aspect can be used by logic solvers that include a readback facility to monitor the output current from their output cards or modules. Thus the ability to detect that the actual current being passed is not the desired value can be used to determine the health of the instrument function. The same condition of the actual loop current falling to a low level will also occur if the wiring between the logic solver and the isolator is open circuit.
Using a field device and logic controller, as defined in section 2, with an MTLx54x then a system-loop can be implemented that applies functional safety together with intrinsic safety to meet the requirements of protection against explosion hazards. Note that the transfer of HART communications through the isolator is not considered as part of the safety function of the isolator.
It should be recognised that the systematic capability of the products limits their application to SIL2 loops.
It is important that the effect of electromagnetic interference on the operation of any safety function is reduced where possible. For this reason it is recommended that the cable connections from the logic solver to the isolator modules be a maximum of 30 metres and are not exposed to possible induced surges, keeping them inside a protected environment.
Similarly, operation of the equipment outside of its environmental ratings induces component stress and temperature above the normal ambient of 60°C is to be avoided to ensure required performance.
4 Assessment of functional safety
The design features and the techniques/measures used to prevent systematic faults are suitable for the use of the MTLx546 and MTLx549 modules in safety functions up to SIL2 in a simplex architecture.
The hardware assessment shows that MTLx54x analogue output modules:
• have a hardware fault tolerance of 0
• are classified as Type A devices (“Non-complex” component with well-defined failure modes)
• There are no internal diagnostic elements of these products.
There are two particular aspects of safety that must be considered when installing the MTL4500 or MTL5500 modules and these are:
• Functional safety
• Intrinsic safety
Reference must be made to the relevant sections within the instruction manual for MTL4500 Series (INM4500) or MTL5500 Series (INM5500) which contain basic guides for the installation of the interface equipment to meet the requirements of intrinsic safety. In many countries there are specific codes of practice, together with industry guidelines, which must also be adhered to.
Provided that these installation requirements are followed then there are no additional factors to meet the needs of applying the products for functional safety use.
To guard against the effects of dust and water the modules should be mounted in an enclosure providing at least IP54 protection degree, or the location of mounting should provide equivalent protection such as inside an equipment cabinet.
In applications using MTL4500 Series, where the environment has a high humidity, the mounting backplanes should be specified to include conformal coating.
To follow the guidelines pertaining to operation and maintenance of intrinsically safe equipment in a hazardous area, yearly periodic audits of the installation are required by the various codes of practice.
In addition, proof-testing of the loop operation to conform with functional safety requirements should be carried out at the intervals determined by safety case assessment.
Proof testing must be carried out according to the application requirements, but it is recommended that this be carried out at least once every three years.
Refer to Appendix B for the proof testing procedure of the MTL4500 or MTL5500 modules.
Note that there may also be specific requirements laid down in the E/E/PE operational maintenance procedure for the complete installation.
If an MTL4500 or MTL5500 module is found to be faulty during commissioning or during the normal lifetime of the product then such failures should be reported to MTL. When appropriate, a Customer Incident Report (CIR) will be notified to enable the return of the unit to the factory for analysis. If the unit is within the warranty period then a replacement unit will be sent.
Consideration should be made of the normal lifetime for a device of this type which would be in the region of ten years.