AUMA AC 01.2-22X Manuel utilisateur

Multi-turn actuators

SA 25.1 –SA 40.1

SAEx 25.1 –SAEx 40.1

with actuator controls

AC 01.2 -22X/-22Y

ACExC 01.2 -22X/-22Y

Functional safetyManual

NOTICE for use!

This document is only valid with the latest operation instructions attached to the device, the attached manual as

well as the respectively pertaining technical and electrical data sheets.They are understood as reference

documents.

Purpose of the document:

The present document informs about the actions required for using the device in safety-related systems in

accordance with IEC 61508 or IEC 61511.

Reference documents:

●Operation instructions (Assembly and commissioning) for the actuator

●Manual (Operation and setting) AC 01.2/ACExC 01.2 actuator controls

●Manual (Device integration Fieldbus) AC(V) 01.2/AC(V)ExC 01.2 actuator controls

●Technical data for multi-turn actuator and actuator controls.

Reference documents are available on the Internet at: http://www.auma.com.

Table of contents Page

41. Terminology............................................................................................................................ 41.1. Abbreviations and concepts

62. Application and validity......................................................................................................... 62.1. Range of application 62.2. Standards 62.3. Valid device types

73. Architecture, configuration and applications...................................................................... 73.1. Architecture (actuator sizing) 83.2. Configuration (setting)/version 103.3. Protection against uncontrolled operation (self-locking/brake) 113.4. Operation mode (low/high demand mode) 113.5. Further notes and indications on architecture 113.6. Applications (environmental conditions)

124. Safety instrumented system and safety functions............................................................. 124.1. Safety instrumented system including an actuator 124.2. Safety functions 134.3. Safe inputs and outputs 134.4. Redundant system architecture 144.5. Examples of applications 164.6. System representation

175. Installation, commissioning and operation......................................................................... 175.1. Installation 195.2. Commissioning 195.3. Operation 205.4. Lifetime 205.5. Decommissioning

216. Indications on display............................................................................................................ 216.1. Status indications on SIL functions 226.2. SIL configuration warning 226.3. Backlight

Multi-turn actuators

Table of contents SA .1 with AC 01.2-22X/-22Y/ACExC 01.2-22X/-22Y

237. Signals..................................................................................................................................... 237.1. Signals via SIL module 237.2. SIL - fault signal via the standards actuator controls display (for troubleshooting support) 247.3. Status signals via output contacts (digital outputs) of standard actuator controls 257.4. Signals via fieldbus of standard actuator controls

268. Tests and maintenance.......................................................................................................... 268.1. Safety equipment: check 268.2. Actuator monitoring for ESD safety function 268.2.1. Partial Valve Stroke Test (PVST): execute 288.3. Actuator monitoring for “safe end position feedback”safety function 288.4. Proof test (verification of safe actuator function) 298.4.1. Preliminary tests 298.4.2. Check Safe ESD safety operation “Safe OPENING/CLOSING”308.4.3. Check SIL fault signal “Actuator monitoring”318.4.4. Check Safe ESD reaction for “Motor protection (thermal fault)”signals 328.4.5. Check Safe ESD reaction to “Limit seating with overload protection”(limit and/or torque

evaluation) 338.4.6. Check Safe ESD reaction to “Forced limit seating in end position”(limit evaluation) –

for actuators with electromechanical control unit 348.4.7. Check Safe ESD reaction to “Forced limit seating in end position”(limit evaluation) –

for actuators with electronic control unit and limit switches 358.4.8. Check Safe ESD reaction to “Forced torque seating in end position”(torque after limit

evaluation) 358.4.9. Check Safe ESD reaction for “no seating”(no evaluation of limit and torque) 378.4.10. Check Safe STOP function 378.4.11. Check combination of Safe ESD and Safe STOP function 388.4.12. Check “Safe end position signal”safety function 398.5. Maintenance

409. Safety-related figures............................................................................................................. 409.1. Determination of the safety-related figures 419.2. Specific figures for AC 01.2 actuator controls in 22X or 22Y version with actuators of the SA .1

type range

4310. SIL Declaration of Incorporation...........................................................................................

47Index........................................................................................................................................

Multi-turn actuators

SA .1 with AC 01.2-22X/-22Y/ACExC 01.2-22X/-22Y Table of contents

1. Terminology

Information sources ●IEC 61508-4, Functional safety of electrical/electronic/programmable electronic

safety-related systems –Part 4: Definitions and abbreviations

●IEC 61511-1, Functional safety - Safety instrumented systems for the process

industry sector –Part 1:Framework, definitions, system, hardware and software

requirements

1.1. Abbreviations and concepts

To evaluate safety functions, the lambda values or the PFD value (Probability of

Dangerous Failure on Demand) and the SFF value (Safe Failure Fraction) are the

main requirements.Further figures are required to assess the individual components.

These figures are explained in the table below.

Table 1:Abbreviations of safety figures

DescriptionFull expressionAbbrevi-

ation Number of safe failuresLambda SafeλSNumber of dangerous failuresLambda DangerousλDNumber of undetected dangerous fail-

ures

Lambda Dangerous UndetectedλDU

Number of detected dangerous failuresLambda Dangerous DetectedλDD Diagnostic Coverage - ratio between

the failure rate of dangerous failures

detected by diagnostic tests and total

rate of dangerous failures of the com-

ponent or subsystem.The diagnostic

coverage does not include any failures

detected during proof tests.

Diagnostic CoverageDC

Mean time between the occurence of

two subsequent failures

Mean Time Between FailuresMTBF

Fraction of safe failures as well as of

detectable dangerous failures

Safe Failure FractionSFF

Average probability of dangerous fail-

ures on demand of a safety function.

Average Probability of dangerous Fail-

ure on Demand

PFDavg

Ability of a functional unit to execute a

required function while faults or devi-

ations are present.HFT = n means that

the function can still be safely executed

for up to n faults occurring at the same

time.

Hardware Fault ToleranceHFT

Interval for proof testProof test intervalTproof

SIL Safety Integrity Level

The international standard IEC 61508 defines 4 levels (SIL 1 through SIL 4).

Safety function Function to be implemented by a safety-related system for risk reduction with the

objective to achieve or maintain a safe state for the plant/equipment with respect to

a specific dangerous event.

Safety instrumented

function (SIF) Function with specified safety integrity level (SIL) to achieve functional safety.

Safety instrumented

system (SIS) Safety instrumented system for executing a single or several safety instrumented

functions.An SIS consists of sensor(s), logic system and actuator(s).

Safety-related system A safety-related system includes all factors (hardware, software, human factors)

necessary to implement one or several safety functions. Consequently failures of

safety function would result in a significant increase in safety risks for people and/or

the environment.

A safety-related system can comprise stand-alone systems dedicated to perform a

particular safety function or can be integrated into a plant.

Multi-turn actuators

Terminology SA .1 with AC 01.2-22X/-22Y/ACExC 01.2-22X/-22Y

Proof test Periodic test performed to detect dangerous hidden failures in a safety-related system

so that, if necessary, a repair can restore the system to an "as new" condition or as

close as practical to this condition.

MTTR (MeanTimeTo

Restoration) Mean time to restoration once a failure has occurred. Indicates the expected mean

time to achieve restoration of the system.It is therefore an important parameter for

system availability.The time for detecting the failure, planning tasks as well as

operating resources is also included.It should be reduced to a minimum.

MRT (Mean RepairTime) Mean repair time indicates the mean time required to repair a system.The MRT is

crucial when defining the reliability and availability of a system.The MRT should

preferably be small.

Device type (type A and

type B) Actuator controls can be regarded as type A devices if all of the following conditions

are met for all components required to achieve the safety instrumented function:

●The failure modes for all constituent components involved are well defined

●The behaviour under fault conditions can be completely determined.

●There is sufficient dependable failure data from the field to show that the claimed

rates of failure are met (confidence level min. 70 %).

Actuator controls shall be regarded as type B devices if one or several of the following

conditions are met:

●The failure of at least one constituent component is not well defined.

●The fault behaviour is not completely known.

●There is insufficient dependable failure data to support claims for rates of failure

for detected and undetected dangerous failures.

PTC (ProofTest Cover-

age) Proof test coverage describes the fraction of failures which can be detected by means

of a proof test.

Multi-turn actuators

SA .1 with AC 01.2-22X/-22Y/ACExC 01.2-22X/-22Y Terminology

2. Application and validity

2.1. Range of application

AUMA actuators and actuator controls in 22X or 22Y version are intended for

operation of industrial valves and are suitable for use in safety instrumented systems

in accordance with IEC 61508 or IEC 61511.

2.2. Standards

Both actuators and actuator controls meet the following requirements:

The safety figures of the devices described meet the requirements of IEC 61508:

2010 in the respective SIL level with regard to failure rates and architecture

requirements.However, this does not imply that all further requirements of IEC 61508

are met.

2.3. Valid device types

The data on functional safety contained in this manual applies to the device types

indicated.

Table 2:Overview on suitable device types

Power supplyType MotorActuator controlsActuator 3-phase ACAC 01.2 in 22X or 22Y versionSA 25.1 –SA 40.1 3-phase ACACExC 01.2 in 22X or 22Y versionSAEx 25.1 –SAEx 40.1

Hardware, software and configuration of actuator and actuator controls must not be

modified without prior written consent by AUMA. Unauthorised modification may

have a negative impact on both safety figures and SIL capability of the products.

Information In applications with requirements on functional safety, only AUMA actuator controls

and actuators in SFC , SIL, 22X or 22Y versions may be used.

AUMA actuator controls and actuators in 22X or 22Y version can among others be

identified from the letters “22X”or “22Y”on the name plate.

Figure 1: Example of name plate with “22X”marking.

Figure 2: Example of SA name plate with marking “22X”

Multi-turn actuators

Application and validity SA .1 with AC 01.2-22X/-22Y/ACExC 01.2-22X/-22Y

3. Architecture, configuration and applications

3.1. Architecture (actuator sizing)

For actuator architecture (actuator sizing) the maximum torques, run torques and

operating times are taken into consideration.

Incorrect actuator architecture can lead to device damage within the safety-

related system!

Possible consequences:Valve damage, motor overheating, contactor seizure,

damage to the electronics, heating up or damage to cables.

→The actuator technical data must imperatively be observed when selecting the

actuator.

→Sufficient reserves have to be provided to ensure that actuators are capable of

reliably opening or closing the valve even in the event of an accident or under-

voltage.

Architecture when using the Safe STOP function

Information For the Safe STOP function, the motor is switched off, overrun may possibly occur!

Valve damage due to overrun!

→For the Safe STOP function, the overrun of the arrangement (actuator, gearbox,

valve) and the reaction time have to be observed.

→If the application requires self-locking of the actuator, please consult AUMA.

Architecture when using the Safe ESD function

Actuators with electromechanical control unit:

For “SIL seating”= “no seating”(without end position protection), we recommend:

●To prevent valve damage during safety operation, we recommend, depending

on the stiffness, sizing the valve to 3 –5 times the maximum actuator torque.

●To avoid thermal damage due to excessive currents, we recommend monitoring

(assessing) the motor protection.

Actuators with electronic control unit MWG:

Information End position signalling (limit switching) and torque signalling via the electronic control

unit MWG are not considered as safe signals.

●To prevent valve damage during safety operation, we recommend, depending

on the stiffness, sizing the valve to 3 –5 times the maximum actuator torque.

●To avoid thermal damage due to excessive currents, we recommend monitoring

(assessing) the motor protection.

Actuators with electronic control unit MWG including limit switches:

For “SIL seating”= “no seating”(without end position protection), we recommend:

●To prevent valve damage during safety operation, we recommend, depending

on the stiffness, sizing the valve to 3 –5 times the maximum actuator torque.

●To avoid thermal damage due to excessive currents, we recommend monitoring

(assessing) the motor protection.

Multi-turn actuators

SA .1 with AC 01.2-22X/-22Y/ACExC 01.2-22X/-22Y Architecture, configuration and applications

Information For “SIL seating”= “Forced limit seating in end position”, the seating is performed

via limit switches in the end position.Since each switch has a hysteresis, the actuator

leaves the end position prior to limit switch release.Consequently, there is a marginal

range of actuator positions to the safety position, for which the limit switch is still

operated when leaving the safety position for which the Safe ESD function is therefore

NOT available. In this case, safety function triggering leads to actuator standstill. If

the range in question is approached from the opposite direction, this limitation does

not apply. In general this range is relatively small. However, for unfavourable config-

urations (low number of turns per stroke), this range can amount to more than 10 %

of the total stroke.

Should, within the framework of unfavourable conditions, the effect described above

represent an unacceptable limitation for the safety function, we recommend applying

the configuration “Forced torque seating in end position”or “no seating”for safety

operation.

Architecture when using the “safe end position feedback”

Safe end position feedback is exclusively available with the 22Y version. Only the

mechanical end position switches directly wired to the customer output may be used

for safe end position feedback.The signals at the DOUT 1 –DOUT 6 outputs of the

I/O interface, the analogue outputs designated with AOUT and the fieldbus interfaces

of the AC.2 / ACExC .2 do not represent safe feedback within the meaning of

functional safety.

Information For the “Safe end position feedback”safety function, heed that signalling is made

via mechanical switches.Since these elements have an unavoidable hysteresis, the

actuator slightly leaves the end position before the end position signal is deleted.

Consequently, there is a marginal range of actuator positions to the safety position,

for which the end position is still signalled although the actuator has already left the

end position during operation from safety position.If the range in question is ap-

proached from the opposite direction, this limitation does not apply. In general this

range is relatively small. However, for unfavourable configurations (low number of

turns per stroke), this range can amount to more than 10 % of the total stroke.

Should, within the framework of unfavourable conditions, the effect described above

represent an unacceptable limitation for the safety function, we recommend evaluating

both limit and torque switches for the end position feedback.

Power supply

Information The plant operator is responsible for power supply.

3.2. Configuration (setting)/version

Configuration (setting) of safety-related functions is defined in the factory during

actuator controls assembly and validated during final inspection. Subsequent

modification of the configuration by the plant operator is not permissible.

General functions are set as described in the Operation instructions or the Manual

(Operation and setting) AUMATIC AC 01.2.

Configuration of safety-related functions is listed in the order-related technical data

sheet.

Multi-turn actuators

Architecture, configuration and applications SA .1 with AC 01.2-22X/-22Y/ACExC 01.2-22X/-22Y

Configuration options for safety function

Table 3:

Configuration options for safety function

Short descriptionConfiguration

SIL function

Safe CLOSINGSafe ESD CLOSE/CLOSE

Safe OPENINGSafe ESD OPEN/OPEN

Safe STOP in direction CLOSE and direction OPENSafe STOP CLOSE/OPEN

Safe CLOSING and safe STOP in direction CLOSE and direc-

tion OPEN

Safe ESD CLOSE/CLOSE + Safe STOP

CLOSE/OPEN

Safe OPENING and safe STOP in direction CLOSE and direc-

tion OPEN

Safe ESD OPEN/OPEN + Safe STOP

CLOSE/OPEN

When configuring a Safe ESD function and a Safe STOP function, the Safe ESD

function is always prioritised compared to the Safe STOP function when requested

simultaneously.

Seating configuration options

Information Seating of standard actuator controls should be configured as set forth in the tables

below.

Table 4:

For actuators with electromechanical control unit:

Configuration

Type of seating

Standard actuator controls

Short descriptionConfiguration

SIL seating type

Freely selectableNo seating by limit or torque switches during

safety operation

1 = No seating

Torque seatingSafety operation is stopped if both limit and

torque switches trip simultaneously

2: Forced torque seating

in end position

Limit seatingFailure operation is stopped by limit switch trip-

ping

3: Forced limit seating in

end position

Limit seatingFailure operation is stopped by tripping the limit

switches and/or the torque switches (overload

protection).

4: Limit seating with

overload protection

Table 5:

for actuators with electronic control unit MWG

Configuration

Type of seating

Standard actuator controls

Short descriptionConfiguration

SIL seating type

Freely selectableNo seating by limit or torque switches during

safety operation

1 = No seating

Table 6:

for actuators with electronic control unit MWG including limit switches

Configuration

Type of seating

Standard actuator controls

Short descriptionConfiguration

SIL seating type

Limit seatingFailure operation is stopped by limit switch trip-

ping

3: Forced limit seating in

end position

Multi-turn actuators

SA .1 with AC 01.2-22X/-22Y/ACExC 01.2-22X/-22Y Architecture, configuration and applications

Configuration options for motor protection assessment

Table 7:

Configuration options for motor protection assessment

Short descriptionConfiguration

SIL motor protection

Tripping of the motor protection (thermal fault) stops or prevents safety oper-

ation

Active

Motor protection has no impact on the safety operationInactive

Information “SIL motor protection”= “inactive”configuration is only set if explicitly required.The

version does not meet the Ex approval requirements.

Information If limit and/or torque switches for the end positions are available, precise setting is

imperative to ensure correct function of the “Safe end position feedback”or the “ESD

function”.For setting details related to the respective switches, please refer to oper-

ation instructions.

Configuration of “reaction monitoring”diagnostics and “Partial Valve Stroke

Test (PVST)”

Depending on the type of diagnostics specified, the reaction monitoring via blinker

transmitter or Partial Valve Stroke Test configurations have to be checked and

adapted, if required.

For detailed configuration options as well as detailed information on the PartialValve

StrokeTest (PVST), refer to Manual (Operation and setting) AUMATIC AC 01.2.

Please note that reaction monitoring may only be executed via the blinker

transmitter/SIL fault signal and not via the reaction monitoring function of the AC .2

firmware.

3.3. Protection against uncontrolled operation (self-locking/brake)

For self-locking AUMA actuators, it can be assumed that a load up to maximum

torque will not result in uncontrolled valve operation from standstill due to valve torque

load.Consequently, in these cases, further protection against uncontrolled operation

is not imperatively required.This might become necessary if, for example, self-locking

can either not be guaranteed due to vibration or if it is insufficient.In addition, certain

applications may require active position locking, for example by using a brake.There

are user-specific standards demanding this type of protection.Therefore, each project

must be subject to individual verification if any further protection is required. In any

case, this protection is required for actuators without self-locking.

Table 8: Overview self-locking for AUMA actuators (at the time of printing of this document)

Self-lockingOutput speedType

60 Hz50 Hz

Self-locking≤108 rpm≤90 rpmSA 25.1 –SA 30.1

SAEx 25.1 –SAEx 30.1 NOT self-locking≥150 rpm≥125 rpm

Self-locking≤26 rpm≤22 rpmSA 35.1

SAEx 35.1 NOT self-locking≥38 rpm≥32 rpm

Self-locking≤26 rpm≤22 rpmSA 40.1

SAEx 40.1 NOT self-locking≥38 rpm≥32 rpm

If actuators with insufficient self-locking function paired with “Forced torque seating

in end position”SIL seating type are used for the safety function, the following effect

might occur:During ESD, the actuator operates to the end position and switches off

due to reaching the end position and the tripping torque.Thereafter, the gear train

is relieved and the torque falls below the preset limit value. As a matter of fact, the

actuator controls detect this incident and switch the actuator on again since the

behaviour is correctly considered as termination of the ESD condition.The latter

generates additional torque until the switching off condition is reached again, and

so on.The “pumping effect”of the actuator is the consequence.

Multi-turn actuators

Architecture, configuration and applications SA .1 with AC 01.2-22X/-22Y/ACExC 01.2-22X/-22Y

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels AUMA Contrôleurs

AUMA

AUMA SGExC 05.1 Manuel utilisateur

AUMA

AUMA EQ 40 Instructions de montage

AUMA

AUMA SG 05.1 Manuel utilisateur

AUMA

AUMA Aumatic AC 01.1 Manuel utilisateur

AUMA

AUMA SA 07.1 Manuel utilisateur

AUMA

AUMA SQ 05.2-SQ 14.2 Manuel utilisateur

AUMA

AUMA PROFOX PF-M25 Manuel utilisateur

AUMA

AUMA AM 01.1 Manuel

AUMA

AUMA Profibus PBD 100 Manuel utilisateur

AUMA

AUMA ACVExC 01.2 Series Manuel

AUMA

AUMA SAR 07.2 Manuel utilisateur

AUMA

AUMA SGExC 05.1 Manuel utilisateur

AUMA

AUMA SAEx 25.1 Manuel utilisateur

AUMA

AUMA SAExC 07.1 Manuel utilisateur

AUMA

AUMA NORM SQ 05.2 Guide de l'administrateur

AUMA

AUMA SEVEN 2SA7 Manuel d'instructions

AUMA

AUMA SQV 05.2 Manuel utilisateur

AUMA

AUMA SG 05.1-F05 Manuel utilisateur

AUMA

AUMA AUMATIC AC 01.2 Manuel

AUMA

AUMA PROFOX PF-Q80 Manuel utilisateur

AUMA

AUMA SA 25.1-UW Manuel utilisateur

AUMA

AUMA LE 12.1 Manuel utilisateur

AUMA

AUMA PROFOX PF-M25 Manuel utilisateur

AUMA

AUMA SAVEx 07.2 Manuel utilisateur

Manuels Contrôleurs populaires d'autres marques

Digiplex

Digiplex DGP-848 Mode d'emploi

YASKAWA

YASKAWA SGM series Manuel utilisateur

Sinope

Sinope Calypso RM3500ZB Manuel utilisateur

Isimet

Isimet DLA Series Style 2 Manuel d'installation

LSIS

LSIS sv-ip5a Manuel utilisateur

Rockwell Automation

Rockwell Automation 1769-L31 Manuel utilisateur

Airflow

Airflow Uno hab Manuel utilisateur

ABB

ABB ACS580-01 drives Manuel utilisateur

Panasonic

Panasonic GM1 Series Manuel utilisateur

Emerson

Emerson SW93 Manuel utilisateur

AutoAqua

AutoAqua Smart ATO micro SATO-120P Manuel utilisateur

Panasonic

Panasonic FP? Positioning Unit RTEX Manuel utilisateur

Samson

Samson Type 5824 Manuel de service

Alpha IP

Alpha IP MIOB 21001 Manuel utilisateur

Siemens

Siemens OpenAir GMA 1 Series Manuel utilisateur

Surecom

Surecom SR-629 Manuel utilisateur

Fishman

Fishman TriplePlay Manuel utilisateur

Regulus

Regulus SRS1 T Manuel utilisateur