ABB Endura AZ20 series User manual

—
ABB MEASUREMENT & ANALYTICS | SAFETY INSTRUCTION | SI/AZ20/AZ30-EN REV. A
Endura AZ20 and Endura AZ30
Oxygen analyzer
Measurement made easy
Introduction
This manual provides information and instructions
that will be needed in order to use the AZ20 or AZ30
in safety related applications. It is aimed at those
responsible for planning, designing, installing,
commissioning and maintaining safety related
systems.
To avoid duplication, many of the standard
procedures are not explained in this document.
However, references are made to user guides,
installation procedures and maintenance
procedures with links to the source material.
—
Endura AZ20 & Endura
AZ30 oxygen analyzer

2ENDURA AZ20 & AZ30 | OXYGEN ANALYZER | SI/AZ20/AZ30-EN REV. A
Contents
1 Overview –versions with SIL available.........3
AZ20 safe area oxygen analyzer .....................3
AZ30 hazardous area oxygen analyzer ...............3
2 Acronyms and abbreviations .................3
Safety Function ....................................3
“Safe” Failure ......................................3
Dangerous Failure .................................3
Type A Subsystems .................................3
Hardware Fault Tolerance (HFT) .....................3
Safe Failure Fraction (SFF) ..........................3
PFD The probability of failure on demand ...........3
Proof Test..........................................3
Safety Integrity Level (SIL) ..........................3
3 Standards and definitions of terms .......... 4
Standard IEC 61508 (2010), Part 1 and 2 ............ 4
Dangerous failure ................................. 4
Safety-related system ............................. 4
Safety function ................................... 4
4 Other applicable documents and papers ......5
5 Zirconia probe as part of the safety function ...
system......................................5
Device-specific data related to functional safety .....5
Failure rates........................................5
6 Functional safety compliance - prerequisites to
operate the device ...........................6
7 Configuration ...............................7
Locking/unlocking the configuration level ...........7
Reset password ....................................7
Configuration of the transmitter ................... 8
Process display....................................10
Information level (Operator Menu)..................10
Configuration Level (Menu) ........................10
Parameter descriptions............................11
8 Proof test ..................................12
Calibration........................................12
AZ20 calibration .............................12
AZ30 calibration .............................12
Inspection ........................................12
9 Repair .....................................12
10 SIL certificate ..............................13

ENDURA AZ20 & AZ30 | OXYGEN ANALYZER | SI/AZ20/AZ30-EN REV. A 3
1 Overview –versions with SIL
available
AZ20 safe area oxygen analyzer
Figure 1 AZ20 remote version
Figure 2 AZ20 integral version
Identifier:
AZ20/xxxxxxxxxxxxx0xx/STD
AZ30 hazardous area oxygen analyzer
Figure 3 AZ30 remote version
Figure 4 AZ30 integral version
Identifier:
AZ30/xxxxxxxxxxxxxxxx/STD
2 Acronyms and abbreviations
Safety Function
A defined function executed by a safety related system which is
intended to achieve or maintain a safe state in respect of a
specific hazardous event.
“Safe” Failure
A failure which forces the safety instrumented system into a
spurious annunciation state. This is usually synonymous with
the term “spurious trip”.
Dangerous Failure
A failure which has the potential to put the safety instrumented
system in a dangerous or non-functioning state. This is usually
synonymous with the term “failure to trip”
Type A Subsystems
A subsystem is Type A if all of the following are true:-
The failure modes of all components are well defined
The behaviour of the subsystem under fault conditions can be
completely determined
There is sufficient dependable field failure data to show that
the claimed failure rates for detected and undetected
dangerous failures are met.
Hardware Fault Tolerance (HFT)
The ability to continue to provide a safety function in the
presence of faults and errors. A hardware fault tolerance of N
means that N+1 faults could cause the loss of a safety function.
Safe Failure Fraction (SFF)
The fraction of failures that does not have the potential to put
the safety instrumented system in a dangerous or non-
functioning state. This figure is sometimes expressed as a
percentage.
PFD The probability of failure on demand
This is intended to apply to systems operating in a low demand
mode where the safety function is required on average a
maximum of once per year.
Proof Test
Periodic tests that are performed to detect failures so that, if
necessary, the system can be restored to a fully working state.
Safety Integrity Level (SIL)
IEC 61508 defines four Safety Integrity Levels from SIL1 to SIL4.
Each of these corresponds to a range of probabilities that the
safety function will fail. The higher the SIL the lower the
probability of failure and the greater the probability that the
safety function will work when required to do so.
Table 1 on page 4 shows the dependency of the SIL on the
probability of failure on demand (PFD for low demand mode of
operation.

4ENDURA AZ20 & AZ30 | OXYGEN ANALYZER | SI/AZ20/AZ30-EN REV. A
…2 Acronyms and abbreviations
…Safety Integrity Level (SIL)
Table 1 Safety Integrity Levels
Safety Integrity Level Low demand mode of operation
4 ≥ 10-5 to 10-4
3 ≥ 10-4 to 10-3
2 ≥ 10-3 to 10-2
1 ≥ 10-2 to 10-1
3 Standards and definitions of terms
Standard IEC 61508 (2010), Part 1 and 2
Functional safety of electrical/electronic/programmable
electronic safety-related systems (target group: manufacturers
and suppliers of devices).
Dangerous failure
A failure that has the potential to place the safety-related
system in a dangerous state or render the system inoperative.
Safety-related system
A safety-related system performs the safety functions that are
required to achieve or maintain a safe condition, e.g., in a plant.
Example:
Pressure meter, logics unit (e.g., limit signal generator) and
valve form a safety-related system.
Safety function
A specified function that is performed by a safety-related
system with the goal, under consideration of a defined
hazardous incident, of achieving or maintaining a safe
condition for the plant.
Example:
Limit pressure monitoring.

ENDURA AZ20 & AZ30 | OXYGEN ANALYZER | SI/AZ20/AZ30-EN REV. A 5
4 Other applicable documents and
papers
Table 2 AZ20 reference documents
Data Sheet
Endura AZ20 oxygen analyser
Combustion Gas Analysis
DS/AZ20-EN
Maintenance Guide
Endura AZ20 oxygen analyser
Combustion Gas Analysis
IM/AZ20M-EN
User Guide
Endura AZ20 oxygen analyser
Combustion Gas Analysis
IM/AZ20P-EN
Manual
Endura AZ20 oxygen analyser
Combustion Gas Analysis
IM/AZ20E-EN
Table 3 AZ30 reference documents
Data Sheet
Endura AZ30 oxygen analyser
Combustion Gas Analysis
DS/AZ30-EN
Maintenance Guide
Endura AZ30 oxygen analyser
Combustion Gas Analysis
MI/AZ30M-EN
User Guide
Endura AZ30 oxygen analyser
Combustion Gas Analysis
OI/AZ30P-EN
Programming Guide
Endura AZ30 oxygen analyser
Combustion Gas Analysis
COI/AZ30E-EN
5 Zirconia probe as part of the
safety function system
The AZ20 or AZ30 transmitter generates an analog signal (4 to
20 mA) proportional to the oxygen % content. The analog signal
is fed to a downstream logics unit such as a PLC or a limit signal
generator, and is monitored for exceeding a specified
maximum or minimum value.
The following elements of the detector are considered to be
within the boundary of the safety system covered in this
manual:
• AZ20 or AZ30 probe
• AZ20 or AZ30 transmitter
• Interconnecting cable (only applicable to remote transmitter
versions)
The safe operation of anything else beyond the above
components falls outside the scope of this document.
Note:
HART is not considered part of the SIL output
Device-specific data related to functional
safety
Table 4 Device-specific data
Device type AZ20 oxygen analyzer
AZ30 oxygen analyzer
Type of assessment IEC61508
Hardware type tolerance 0
Component type B
Failure rates
Table 5 Failure rates
High demand Low demand
Safety integrity SIL 1 SIL 2
“hazardous” failure
(revealed)
0.28 10-2 per annum 3.11 10-6 per hour
“hazardous” failure
(unrevealed)
2.72 10-2 per annum 3.22 10-7 per hour
“safe” failure
(revealed)
0 0.54 10-6 per hour
“safe” failure
(unrevealed)
0 0
Diagnostic coverage >91 % 90.6 %
Safe failure fraction >91 %
Probability of failure
on demand
1.6 10-3

6ENDURA AZ20 & AZ30 | OXYGEN ANALYZER | SI/AZ20/AZ30-EN REV. A
…5 Zirconia Probe as part of the
safety function system
…Failure rates
Notes:
1 Auto-diagnosed failures are assumed to be dealt within 48
hours. Undiagnosed failures are assumed to be revealed
subject to a proof-test interval of one year.
2 The equipment is in virtually continuous use such that failure
rates (based on 8760 hours per year) are applicable.
6 Functional safety compliance -
prerequisites to operate the device
• The analog signal of the transmitter can be considered safe
after 2 hours (warm up time), or after the heater output
stabilizes (see signal view).
• A dangerous error is an error during which the output of the
transmitter no longer responds to the input signal or deviates
by more than 2 %.
• The maximum reaction time of the device on error is less than
10 minutes.
• Use of the device in a safety-related system is only permitted
within the first 20 years after production of the device. This is
a basis for the calculated failure rates.
• The ambient temperature for use in a safety-related system
must be above –40 °C. The information according to the
operating instructions applies to the upper limit of the
ambient temperature.
• When using the device for the measurement of corrosive
media, keep in mind the limitations referred to in the
operating instructions or data sheet.
• Selection of the correct version of probe or transmitter is the
operator’s responsibility.

ENDURA AZ20 & AZ30 | OXYGEN ANALYZER | SI/AZ20/AZ30-EN REV. A 7
7 Configuration
This document does not replace the standard installation
manuals for the AZ20 or AZ30. For full details on how to safely
install and configure AZ20 and AZ30 probes, please refer to the
documentation listed in section 4 on page 5.
However, in this section are listed some areas that are not
absolutely necessary for operation, but can affect the safety
function.
Locking/unlocking the configuration level
SAFETY NOTE
Unauthorized changes of the parameter settings may affect
the safety function.
Once configuration is completed, the device must be
protected against unauthorized access.
Passwords can be set in Device Menu > Security setup.
Users with standard access can change the password for
standard users and users with advanced access can set
passwords for both standard and advanced users.
Security setup Used to set Standard and Advanced
level passwords of up to 6
alphanumeric characters.
Note. Standard and Advanced
passwords are not set at the factory
and must be set by the end-user(s).
None
Standard Set by Standard and Advanced users
Advanced Set by Advanced users
Reset password
If the password has been forgotten, there is an option to reset
it. Please refer to ABB to have your password reset.

8ENDURA AZ20 & AZ30 | OXYGEN ANALYZER | SI/AZ20/AZ30-EN REV. A
…7 Configuration
Configuration of the transmitter
At power-up, Operator Page 1 is displayed – this is the normal
operating state of the transmitter. The Operator Menu is
accessed by pressing for Operator Menu details. The
Access Level is accessed by pressing .
Operator Page 1
Operator Page 2
Autoscroll
Signals View
Operator Menu
Operator Menu Operator Page 1 Access Level
21.0
12.00
Standard
Advanced
Service
Access Level
%O2
°C
0%
O2
TMP
O/P

ENDURA AZ20 & AZ30 | OXYGEN ANALYZER | SI/AZ20/AZ30-EN REV. A 9










Overview of top level menus
Menu Menu
Menu
Menu
Menu Menu
Menu
Menu
Menu
Exit Select
Exit Select
Exit Select
Exit Select
Exit Select
Exit Select
Exit Select
Exit Select
Exit Select
Easy Setup
Calibrate Process Alarm
Diagnostics Input/Output
Device Setup Communication
Display Device Info

10 ENDURA AZ20 & AZ30 | OXYGEN ANALYZER | SI/AZ20/AZ30-EN REV. A
…7 Configuration
Process display
Operator Page 1 shows the current process values and is the
default page at start-up or during operation.
There are two main levels accessible from this page
Information level (Operator Menu)
The information level contains the parameters and information
that are relevant for the operator.
The device configuration cannot be altered on this level.
Configuration Level (Menu)
SAFETY INSTRUCTIONS
The following parameters may affect the safety function,
some of which must be set during installation so that an
application as part of a safety function is possible.
To exclude interim changes and to ensure the suitability for
the intended use, the following parameters need to be
checked after activation of the write protection and before
taking the safety function into operation.
For AZ20, the instructions for settings and installation can
be found in the User Guide and Manual.
For AZ30, the instructions for settings and installation can
found in the User Guide and Programming Guide.
The configuration level contains all the parameters required for
device commissioning and configuration. The device
configuration can be changed in this level.