Emerson EL-O-Matic F-Series User guide

SIL Safety Manual
DOC.SILM.EF.EN Rev. 1
September 2018
EL-O-Matic F-Series
SIL Safety Manual
EL MaticTM
EL MaticTM

SIL Safety Manual
DOC.SILM.EF.EN Rev. 1
Table of Contents
September 2018
ITable of Contents
Table of Contents
Section 1: Introduction
Section 2: Functional Specification
Section 3: Configuration of the Product
Section 4: Service Condition Limitations (Limitation of Use)
Section 5: Expected Lifetime
Section 6: Failure Modes and Estimated Failure Rates
Section 7: Installation and Site Acceptance Procedure
Section 8: Periodic Test and Maintenance Requirements
8.1 General...................................................................................................... 9
8.2 Full-Stroke Test .......................................................................................... 9
8.3 Partial-Stroke Test.................................................................................... 12
8.4 Proof Test and Periodic Maintenance........................................................ 15
Section 9: Architectural Constraints
Section 10: Common Cause Factors
Section 11: Mean Repair Time
Section 12: Systematic Capability

1
September 2018
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1
Introduction
Section 1: Introduction
Purpose of this Safety Manual, written in compliance with IEC 61508-2, Annex D, is to give
all the necessary information to the system integrator for a correct use of the product in
Safety Instrumented Systems for SIL classied applications.
Section 1: Introduction

2
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1 September 2018
Functional Specication
Section 2: Functional Specication
The safety function for El-O-Matic F-Series pneumatic actuator is dened as follows:
Double-Acting Scenario:
a. When an unsafe condition is detected in a plant by a process sensor, the
controller, via actuator control system, drives the Actuator to close the
shut-down valve, depressurizing (if under pressure) the Opening side of
the actuator and pressurizing the Closing side of the actuator.
b. When an unsafe condition is detected in a plant by a process sensor, the
controller, via actuator control system drives the Actuator to open the
blow-down valve, depressurizing (if under pressure ) the Closing side
of the pneumatic actuator and pressurizing the Opening side of the
pneumatic actuator.
Single-Acting Scenario:
a. When an unsafe condition is detected in a plant by a process sensor, the
controller, via actuator control system drives the Actuator to rotate with
sufcient torque to move a valve to its fail-safe state when hold-position
air pressure is released.
The El-O-Matic brand Actuator Selection Procedure provides functional denition with
specics on input variables and performance.
In any case, the choice of the safety function to be implemented is responsibility of the
system integrator.
Section 2: Functional Specification

3
September 2018
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1
Conguration of the product
Section 3: Conguration of the Product
The El-O-Matic F-Series are pneumatically operated actuators designed to operate Ball /
Plug / Buttery valves, automation of louvers and dampers & automation of any
quarter-turn mechanism. Both the double-acting and single-acting (spring-return) versions
of the El-O-Matic F-Series pneumatic actuators are designed in such a way that there are
no moving parts on the outside (with the exception of the position indicator). This makes
them safe, easy to install and virtually maintenance free.
For further details about actuator congurations, please refer to the El-O-Matic F-Series
product data sheets, Safety guide and Installation, Operation and Maintenance manual.
Section 3: Configuration of the product

4
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1 September 2018
Service Condition Limitations (Limitation of Use)
Section 4: Service Condition Limitations
(Limitation of Use)
The operating capabilities are listed below:
• Maximum Operating Pressure:
– Pneumatic Service
– Up to 120 psig (8.3 barg)
• Ambient Temperature:
Temperature extremes require different solutions to maintain actuator operational
integrity and reliability. For each El-O-Matic F-Series actuator is available in three
different temperature executions.
– -20°C to +80°C (-4°F to +176°F) Standard temperature
– -10°C to +120°C (+14°F to +250°F) High Temperature
– -40°C to +80°C (-40°F to +176°F) Low Temperature
• Torque Output Range:
– Double-Acting El-O-Matic F-Series actuators, requiring pressure to rotate
in either direction, are available with a torque range between 4.8 Nm
(44 lbf.in) and 6,490 Nm (59000 lbf.in)
– The El-O-Matic F-Series spring-return models require pressure in only one
direction of travel and are suitable for air-fail close and air-fail to open
applications without modication. These models are available with a
spring end torque between 2 Nm (20 lbf.in) and 2394 Nm (21000 lbf.in)
• Safety Function:
For spring-return models, the safety function is self-evident performed by the
springs. The safety function of double-acting models should be performed by the
A-chamber for safety related systems.
Figure 1 Use the A-Chamber for Safety Related Systems on Double-Acting Actuators
Assembly Code: CW Assembly Code: CC
= Safety Function is = Safety Function is
Counterclockwise Rotation Clockwise Rotation
AB
AB
A
B
A
B
PistonsPistons
Pinion
Section 4: Service Condition Limitations (Limitation of Use)

5
September 2018
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1
Service Condition Limitations (Limitation of Use)
• Use of manual override:
The use of a manual override is not recommended in a SIL classied application, as
it results in a bypass of the safety function. In case the manual override is used, the
following requirements must be fullled, or the Functional Safety Certication will
become invalid:
– The manual override shall be protected to prevent unauthorized use.
(e.g. by key locks in conjunction with effective management controls.).
– The users authorized to operate on the actuator shall be skilled personnel;
– The maximum duration of the manual override shall be dened.
– If necessary, compensatory measures to allow the safe operation of the
process shall be dened (responsibility of the nal user).
• When test or bypass facilities are included in the SIS (safety integrated system),
they shall conform with the following:
– The SIS shall be designed in accordance with the maintenance and testing
requirements dened in the SRS (safety requirement specication).
– The operator shall be alerted to the bypass of any portion of the SIS via an
alarm or operating procedure.
Before selecting remote operating mode control of actuator, the manual override must be
disengaged according to the relevant Installation, Operation and Maintenance Manual.
The position selected (remote/automatic control or local /manual control) can be achieved
with a specic technical solution that does not allow to reach an intermediate position
lever’s and avoids unintentional activation.
The engagement of the manual override shall be signaled, at least locally, according to
IOM. As optional request from nal user, to determine if the manual override is engaged, an
electrical signal using contact switching can be provided to communicate the status to the
control room.
• Loss of utility:
For double acting congurations that on loss of utility (e.g., electrical power,
or pneumatic supply) does not fail to the safe state a system for detecting and
alarming of loss of utility and SIS circuit integrity shall be implemented. (e.g., end-
of-line monitoring, supply pressure measurement), and action taken according to
par. 11.3 of IEC. 61511-1.
Section 4: Service Condition Limitations (Limitation of Use)

6
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1 September 2018
Expected Lifetime
Section 5: Expected Lifetime
Actuator lifetime (for which failure rates indicated in Section 6 are ensured) strongly
depends on operating conditions.
For normal service conditions, EL-O-Matic F-Series actuators can be in good conditions
also after more than 10 years with planned minimum maintenance. Normal working life is
500.000 cycles. El-O-Matic F-Series carry a warranty period of:
• 18 months after delivery if properly stored in conditions that we declare or
• 12 months after installation on site.
Section 5: Expected Lifetime

7
September 2018
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1
Failure Modes and Estimated Failure Rates
Section 6: Failure Modes and Estimated
Failure Rates
Table 1. Failure Modes and Estimated Failure Rates – El-O-Matic F-Series Actuator
Configuration Safety Function λDU [1/h] λDD [1/h] λS [1/h]
F- No PST 1 2,55E-08 0,00E+00 0,00E+00
F - With PST 1 2,29E-09 2,.32E-08 0,00E+00
NOTE:
• No internal diagnostics is included in the product.
• The above failure rates are guaranteed:
- For the service conditions listed in Section 4.
- For the expected lifetime declared in Section 5.
- Considering the periodic test and maintenance included in Section 8.
The failure rates are determined performing a FMEDA based on the failure rates of
components taken from industrial databases (NPRD-2016/FMD97/2016, EXIDA E&MCRH
and NSWC-2011), integrated with eld feedback using the Bayesian statistical approach
mentioned in IEC 61508-2 Par. 7.4.4.3.3.
The system for reporting failures is based on eld feedback from end users, with:
- Identication of the claim/failure
- Root cause analysis to identify cause and responsibility of the failure
- Identication of the possible effect of the failure on the Safety Function
- Classication of the failure considering the failure categories of IEC 61508-2
(Safe, Dangerous, No Effect) Customer Service, Quality and Technical
Department are responsible for the procedure, according to the respective role.
Section 6: Failure Modes and Estimated Failure Rates