ABB 265Ax Installation instructions

SIL-Safety Instructions
SM 265/7/9 SIL-EN Rev. 02
Pressure Transmitter Series 2000T and
265Ax, 265Gx, 265Vx, 265Dx, 265Jx, 267Cx, 269Cx
Instructions for Functional Safety

2
Pressure Transmitter Series 2000T and 265Ax, 265Gx, 265Vx, 265Dx, 265Jx, 267Cx, 269Cx SM 265/7/9 SIL-EN
Instructions for Functional Safety
Table of contents
Page
1 Field of application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
2 User benefits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
3 Acronyms and abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3
4 Relevant standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
5 Terms and definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
6 Determination of the Safety Integrity Level (SIL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
7 Specifications for the safety function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
8 Applicable device documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
9 Behavior during operation and in case of malfunction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
10 Periodic checks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
11 Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
12 Safety-related characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
13 SIL conformity declaration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
14 Management summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

3
Pressure Transmitter Series 2000T and 265Ax, 265Gx, 265Vx, 265Dx, 265Jx, 267Cx, 269Cx SM 265/7/9 SIL-EN
Instructions for Functional Safety
1 Field of application
Differential pressure, gauge pressure and absolute pressure measurements that shall meet the special safety
requirements according to IEC 61508/ IEC 61511-1.
The measuring unit meets the requirements regarding
• functional safety in accordance with IEC 61508/IEC 61511-1
• explosion protection (depending on the version)
• electromagnetic compatibility in accordance with EN 61326 and NAMUR recommendation NE 21.
2 User benefits
Use for
• Pressure limit monitoring
• Continuous measurement
• Easy commissioning
3 Acronyms and abbreviations
Acronym/ Ab-
breviation Designation Description
HFT Hardware Fault Tolerance The hardware fault tolerance of the device.
This is the capability of a functional unit to continue the execution of the
demanded function in case of faults or deviations.
MTBF Mean Time Between Failures This is the mean time period between two failures.
MTTR Mean Time To Repair This is the mean time period between the occurrence of a failure in a
device or system and its repair.
PFD Probability of Failure on Demand This is the likelihood of dangerous safety function failures occurring on
demand.
PFDav Average Probability of Failure on
Demand This is the average likelihood of dangerous safety function failures occurring on demand.
SIL Safety Integrity Level Safety Integrity Level
The international standard IEC 61508 specifies four discrete Safety
Integrity Levels (SIL 1 to SIL 4). Each level corresponds to a specific
probability range regarding the failure of a safety function. The higher
the Safety Integrity Level of the safety-related systems, the lower the
likelihood of non-execution of the demanded safety functions.
SFF Safe Failure Fraction The fraction of non-hazardous failures, i.e. the fraction of failures without
the potential to set the safety-related system to a dangerous or
impermissible state.
TI Test interval between life testing of
the safety function Time interval between the functional tests of the safety function.
XooY "X out of Y" Voting (e.g. 2oo3) Classification and description of the safety-related system regarding
redundancy and the selection procedure used.
"Y“ indicates how often the safety function is carried out (redundancy).
"X“ determines how many channels must work properly.
Example (pressure measurement): 1oo2 architecture. When one out of
two pressure sensors reaches a defined limit value, a safety-related
system decides, that the pressure limit has to be considered as
exceeded. In a system with a 1oo1 architecture only one pressure
sensor exists.

4
Pressure Transmitter Series 2000T and 265Ax, 265Gx, 265Vx, 265Dx, 265Jx, 267Cx, 269Cx SM 265/7/9 SIL-EN
Instructions for Functional Safety
4 Relevant standards
5 Terms and definitions
6 Determination of the Safety Integrity Level (SIL)
The reachable Safety Integrity Level depends on the following safety-related characteristics:
• Average probability of failure on demand (PFDav)
• Hardware fault tolerance (HFT)
• Safe failure fraction (SFF).
The specific safety-related characteristics for the transmitter as a part of the safety function are detailed in chapter
"Safety-related characteristics".
The following table shows the dependence of the Safety Integrity Level (SIL) on the average probability of failure on
demand (PFDav). The "Low demand mode" is considered, i.e. the maximum demand rate on the safety-related sys-
tem is once per year.
The sensor, the logic unit and the final control element form together a safety-related system which carries out a
safety function. The average probability of failure on demand (PFDav) is usually distributed over the subsystems
(sensor, logic unit and final control element) as seen in the illustration below.
Fig. 6-1: Normal distribution of the average probability of failure on demand
(PFDav) over the subsystems
Standard Designation
IEC 61508,
Part 1 to 7 Functional safety of electrical/electronic/programmable electronic safety-related systems (Target group: Manufacturers and Suppliers of Devices)
IEC 61511,
Part 1 Functional safety – Safety Instrumented Systems for the process industry sector (Target group: Safety Instrumented Systems Designers, Integrators and Users)
Terms Definitions
Dangerous failure Failure with the potential to set the safety-related system to a dangerous or inoperative state.
Safety-related system A safety-related system carries out the safety functions needed to establish or maintain a
safe state e.g. in a plant.
Example: A pressure gauge, a logic unit (e.g. limit signal transmitter) and a valve form a safe-
ty-related system.
Safety function A defined function carried out by a safety-related system in order to establish or maintain a
safe state of the plant under consideration of a specified dangerous incident.
Example: Pressure limit monitoring
Safety Integrity Level (SIL) (Low demand mode)
4PFD
av ≥10-5...< 10-4
3≥10-4...< 10-3
2≥10-3...< 10-2
1≥ 10-2...< 10-1
Sensor
e.g. pressure
sensor
Logic unit
e.g. PLC Final control
element
e.g. valve
≤35 % ≤50 %
≤15 %

5
Pressure Transmitter Series 2000T and 265Ax, 265Gx, 265Vx, 265Dx, 265Jx, 267Cx, 269Cx SM 265/7/9 SIL-EN
Instructions for Functional Safety
IMPORTANT
This documentation applies to the transmitter 265xx as a part of a safety function.
The following table shows the reachable Safety Integrity Level (SIL) of the entire safety-related system for systems
of type B, depending on the safe failure fraction (SFF) and the hardware fault tolerance (HFT). Systems of type B
are e.g. sensors with complex components like microprocessors (see also IEC61508, Part 2).
1) Acc. to IEC 61511-1, Part 11.4.3, the hardware fault tolerance (HFT) of sensors and final control elements with complex com-
ponents can be decreased by one (value in brackets), if the following requirements are met:
– The device is proven-in-field.
– The user can only configure process-related parameters like the measuring range, signal direction in case of fault, etc.
– The device configuration level is access-protected, e.g. by jumper or password
(here: code number or key combination).
– The function has a required Safety Integrity Level (SIL) less than 4.
The transmitter meets all requirements.
Fig. 6-2: Safety function (e.g. for pressure limit monitoring) with 265DS as a subsystem
1) 265DS with local operation option and adjustable lower and upper range value and damping
2) Computer with user interface like SMART VISION for setting all parameters
e.g. alarm behavior, max. alarm, operating mode, etc.
3) Hand-held terminal for setting all parameters, e.g. alarm behavior, max. alarm, operating mode, etc.
The transmitter 2000T / 2600T produces an analog signal (4...20 mA) proportional with the differential pressure or
gauge pressure / absolute pressure. This analog signal is fed to a subsequent logic unit, e.g. a PLC or limit trans-
mitter, and monitored for violation of a defined maximum value. The logic unit must be capable of recognizing HI
alarms (adjustable between 21 and 22.5 mA) and LO alarms (3.6 mA) in order to allow for malfunction detection.
Safe Failure Fraction (SFF) Hardware Fault Tolerance (HFT)
01(0)
1) 2 (1)1)
< 60 % impermissible SIL 1 SIL 2
60...< 90 % SIL 1 SIL 2 SIL 3
90...< 99 % SIL 2 SIL 3 –
≥99 % SIL 3 – –
1)
3)
2)
PC with graphical
user interface
e.g. DSV401 (SMART VISION)
FSK
modem
Hand-held
terminal
Transmitter 265DS
Logic unit
e.g. PLC
Limit transmitter
etc.
4...20 mA
Actuator

6
Pressure Transmitter Series 2000T and 265Ax, 265Gx, 265Vx, 265Dx, 265Jx, 267Cx, 269Cx SM 265/7/9 SIL-EN
Instructions for Functional Safety
7 Specifications for the safety function
NOTICE
Refer to chapters "Settings" and "Safety-related characteristics" of this document for the mandatory settings and
specifications for the safety function.
See the relevant data sheet for the transmitter response time.
IMPORTANT
An MTTR of 8 hours is specified.
Safety-related systems without an auto-locking function must be set to a monitored or otherwise safe state within
the MTTR after execution of the safe function.
8 Applicable device documentation
The following documentation must be available for the transmitter, depending on the model:
Type Oper. instructions Type Oper. instructions
265Dx/Vx IM 265 D/V 2010TD/TA 42/15-712
265Gx/Ax IM 265 G/A 2020TG/TA 42/15-753
267/269Cx IM 267C/269C 2010TC 42/15-714
For explosion-proof devices the respective EC type examination certificate must be available.
9 Behavior during operation and in case of malfunction
Note!
The behavior during operation and in case of malfunction is detailed in the operating instructions.
10 Periodic checks
The operativeness of the transmitter must be checked at appropriate intervals, e.g. by controlling the calibration (see
the respective operating instructions, chapters about operation, calibration, maintenance and repair). We recom-
mend to perform the checks at least once a year. It is the operator's responsibility to define the type of checks and
the checking intervals in the stated time period.
Defective transmitters / assembly groups should be returned to the ABB service and repair department, possibly
with the type of malfunction and possible reason stated. When ordering spare parts or spare units please indicate
the serial number (S/N) and year of manufacture of the original device.
Address:
ABB Automation GmbH
Department Parts & Repair
Schillerstrasse 72
D-32425 Minden
GERMANY

7
Pressure Transmitter Series 2000T and 265Ax, 265Gx, 265Vx, 265Dx, 265Jx, 267Cx, 269Cx SM 265/7/9 SIL-EN
Instructions for Functional Safety
11 Settings
11.1 Alarm behavior and current output
In case of a malfunction the current is set to the selected value. The settings can be made via the ABB user interface
DSV401 (SMART VISION) or via a hand-held terminal.
NOTICE
Check the safety function upon entry of all parameters. The transmitter allows to simulate the signal current inde-
pendently of the measured pressure by using the "Simulation" and "Simulate current" parameters. (These parame-
ters are accessible via DSV401 (SMART VISION) or via the HART hand-held terminal.
11.2 Locking/Unlocking
WARNING
Any changes to the measuring system and its settings after commissioning may impair the safety function. For this
reason it is strongly recommended to disable local transmitter control via the local keys after having entered all
parameters and after having checked the safety function. This is to protect your settings against unwanted or
unauthorized modification. A lock activated via the local keys can only be deactivated by using the keys again.
Fig. 11-1:
12 Safety-related characteristics
12.1 Assumptions
– HART communication is only used for configuring, adjusting or diagnosing the device, but not for safety-relevant
critical operations.
– Cyclic self-diagnosis is executed within one hour and is automatically restarted.
– The repair time after a device fault is 8 hours.
– The long-time average temperature is 40°C.
– The transmitter is only used for low demand mode applications.
– Only the 4...20 mA current signal is evaluated by the safety device.
– A dangerous failure is a failure where the output current does no longer respond to the input signal or deviates
from it by more than 2% referred to the measuring span.
– The safety PLC must be designed such that it reliably recognizes faults leading to both HI alarms and LO alarms.

8
Pressure Transmitter Series 2000T and 265Ax, 265Gx, 265Vx, 265Dx, 265Jx, 267Cx, 269Cx SM 265/7/9 SIL-EN
Instructions for Functional Safety
12.2 Specific safety-related characteristics
For details refer to the management summary in the Appendix.
Transmitter type Measuring range SFF PFDav λdd + λsλdu
2010TD 10 mbar 75 % 8.54 × 10-4 614 FIT 195 FIT
2010TC 10 mbar 76 % 9.43 × 10-4 699 FIT 216 FIT
2010TD
2010TA 60 mbar to 20 bar 400 mbar to 20 bar 73 % 8.65 × 10-4 535 FIT 198 FIT
2010TC 60 mbar to 20 bar 73 % 9.54 × 10-4 620 FIT 218 FIT
2010TD 100 bar 74 % 24.4 × 10-4 1652 FIT 558 FIT
2020TA / 2020TG 60 mbar, 400 mbar 75 % 13.1 × 10-4 917 FIT 300 FIT
2020TA
2020TG
≥ 2.5 bar
≥ 2.5 bar 69 % 9.71 × 10-4 518 FIT 222 FIT
λdd + λs: Fault rate of detected dangerous and of safe faults
λdu: Fault rate of undetected dangerous faults
The characters in brackets indicate the catalog number for the measuring range.
Transmitter type Measuring range SFF PFDav λdd + λsλdu
265Dx (A)
265Jx (A) 10 mbar 75.9 % 8.54 × 10-4 614 FIT 195 FIT
267Cx (A)
269Cx (A) 10 mbar 76.4 % 9.43 × 10-4 699 FIT 216 FIT
265Dx (C,F,L,N)
265Jx (C,F,L,N)
265Vx (F,L,N)
60 mbar to 20 bar
60 mbar to 20 bar
400 mbar to 20 bar
73.0 % 8.65 × 10-4 535 FIT 198 FIT
267Cx (C,F,L,N)
269Cx (C,F,L,N) 60 mbar to 20 bar 74.0 % 9.54 × 10-4 620 FIT 218 FIT
265Dx (R) 100 bar 74.8 % 24.4 × 10-4 1652 FIT 558 FIT
265Ax (C,F)
265Gx (C,F) 60 mbar and 400 mbar 60 mbar and 400 mbar 75.3 % 13.1 × 10-4 917 FIT 300 FIT
265Ax (L,U)
265Gx (L,U,R,V)
≥ 2.5 bar
≥ 2.5 bar 70.0 % 9.71 × 10-4 518 FIT 222 FIT
λdd + λs: Fault rate of detected dangerous and of safe faults
λdu: Fault rate of undetected dangerous faults
The characters in brackets indicate the catalog number for the measuring range.

9
Pressure Transmitter Series 2000T and 265Ax, 265Gx, 265Vx, 265Dx, 265Jx, 267Cx, 269Cx SM 265/7/9 SIL-EN
Instructions for Functional Safety
13 SIL conformity declaration

10
Pressure Transmitter Series 2000T and 265Ax, 265Gx, 265Vx, 265Dx, 265Jx, 267Cx, 269Cx SM 265/7/9 SIL-EN
Instructions for Functional Safety