GMI D5294S User Manual

6
D5294 - 5 A SIL 3 NO contact Relay Out Module for NE or F&G/ND Load with full diagnostic and Modbus G.M. International ISM0123-14
Functional Safety Manual and Applications
Description:
Input Signal from PLC/DCS is normally Low (0 Vdc) and is applied to pins 1-2 in order to Normally De-energize (ND) the internal relays.
Input Signal from PLC/DCS is High (24 Vdc) during “energized to trip” operation, in order to energize the internal relays.
The Load is Normally De-energized (ND), therefore its safe state is to be energized.
Disconnection of the F&G/ND Load is done on both supply lines.
The following table describes the status (open or closed) of each output contact when the input signal is High or Low.
Safety Function and Failure behavior:
D5294S is considered to be operating in Low Demand mode, as a Type A module, having Hardware Fault Tolerance (HFT) = 0.
In the 2nd Functional Safety application, the normal state operation of relay module is de-energized, with ND (Normally De-energized) load.
In case of alarm or request from process, the relay module is energized (safe state), energizing the load.
The failure behaviour of the relay module is described by the following definitions:
 fail-Safe State: it is defined as the output load being energized;
 fail Safe: this failure causes the system to go to the defined fail-safe state without a process demand;
 fail Dangerous: failure mode that does not respond to a demand from the process (i.e. being unable to go to the defined fail-safe state),
so that the output load remains de-energized.
 fail “No effect”: failure mode of a component that plays a part in implementing the safety function but is neither a safe failure nor a dangerous failure;
When calculating the SFF this failure mode is not taken into account.
 fail “Not part”: failure mode of a component which is not part of the safety function but part of the circuit diagram and is listed for completeness;
When calculating the SFF this failure mode is not taken into account.
Failure rate date: taken from Siemens Standard SN29500.
Failure rate table:
Failure rates table according to IEC 61508:2010 Ed.2 :
PFDavg vs T[Proof] table (assuming Proof Test coverage of 99%), with determination of SIL supposing module contributes 10% of total SIF dangerous failures:
PFDavg vs T[Proof] table (assuming Proof Test coverage of 99%), with determination of SIL supposing module contributes >10% of total SIF dangerous failures:
Systematic capability SIL 3.
Operation Input Signal
Pins 1-2
Pins
15 - 13
Pins
16 - 14
F&G/ND Load (SIL3)
Pins 13 - 14
Normal Low (0 Vdc) Open Open De-Energized
Trip High (24 Vdc) Closed Closed Energized
Failure category Failure rates (FIT)

dd
= Total Dangerous Detected failures 0.00

du
= Total Dangerous Undetected failures 3.40

sd
= Total Safe Detected failures 0.00

su
= Total Safe Undetected failures 133.92
λ
tot safe
= Total Failure Rate (Safety Function) = λ
dd
+ λ
du
+ λ
sd
+ λ
su
137.32
MTBF (safety function, single channel) = (1 / λ
tot safe
) + MTTR (8 hours) 831 years

no effect
= “No effect” failures 290.68

not part
= “Not Part” failures 791.79
λ
tot device
= Total Failure Rate (Device) = λ
tot safe
+ λ
no effect
+ λ
not part
1219.79
MTBF (device, single channel) = (1 / λ
tot device
) + MTTR (8 hours) 93 years
T[Proof] = 1 year T[Proof] = 6 years
PFDavg = 1.49 E-05 - Valid for SIL 3 PFDavg = 8.95 E-05 - Valid for SIL 3
T[Proof] = 20 years
PFDavg = 2.98 E-04 - Valid for SIL 3
2)
Application for D5294S - SIL 3 for F&G/ND Load
Load
13
15
- / AC
+ / AC
PLC
Output OFF
0 Vdc
- / AC
+ / AC
PLC
Output ON
24 Vdc
Normal state operation Energized to trip operation
16
14
Load
13
15
16
14
λ
sd
λ
su
λ
dd
λ
du
SFF
0.00 FIT 133.92 FIT 0.00 FIT 3.40 FIT 97.52%

GMI D5294S Specifications

General

Brand	GMI
Model	D5294S
Category	Control Unit
Language	English