Emerson EL-O-Matic F-Series User guide

SIL Safety Manual
DOC.SILM.EF.EN Rev. 1
September 2018
EL-O-Matic F-Series
SIL Safety Manual
EL MaticTM
EL MaticTM

SIL Safety Manual
DOC.SILM.EF.EN Rev. 1
Table of Contents
September 2018
ITable of Contents
Table of Contents
Section 1: Introduction
Section 2: Functional Specification
Section 3: Configuration of the Product
Section 4: Service Condition Limitations (Limitation of Use)
Section 5: Expected Lifetime
Section 6: Failure Modes and Estimated Failure Rates
Section 7: Installation and Site Acceptance Procedure
Section 8: Periodic Test and Maintenance Requirements
8.1 General...................................................................................................... 9
8.2 Full-Stroke Test .......................................................................................... 9
8.3 Partial-Stroke Test.................................................................................... 12
8.4 Proof Test and Periodic Maintenance........................................................ 15
Section 9: Architectural Constraints
Section 10: Common Cause Factors
Section 11: Mean Repair Time
Section 12: Systematic Capability

1
September 2018
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1
Introduction
Section 1: Introduction
Purpose of this Safety Manual, written in compliance with IEC 61508-2, Annex D, is to give
all the necessary information to the system integrator for a correct use of the product in
Safety Instrumented Systems for SIL classied applications.
Section 1: Introduction

2
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1 September 2018
Functional Specication
Section 2: Functional Specication
The safety function for El-O-Matic F-Series pneumatic actuator is dened as follows:
Double-Acting Scenario:
a. When an unsafe condition is detected in a plant by a process sensor, the
controller, via actuator control system, drives the Actuator to close the
shut-down valve, depressurizing (if under pressure) the Opening side of
the actuator and pressurizing the Closing side of the actuator.
b. When an unsafe condition is detected in a plant by a process sensor, the
controller, via actuator control system drives the Actuator to open the
blow-down valve, depressurizing (if under pressure ) the Closing side
of the pneumatic actuator and pressurizing the Opening side of the
pneumatic actuator.
Single-Acting Scenario:
a. When an unsafe condition is detected in a plant by a process sensor, the
controller, via actuator control system drives the Actuator to rotate with
sufcient torque to move a valve to its fail-safe state when hold-position
air pressure is released.
The El-O-Matic brand Actuator Selection Procedure provides functional denition with
specics on input variables and performance.
In any case, the choice of the safety function to be implemented is responsibility of the
system integrator.
Section 2: Functional Specification

3
September 2018
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1
Conguration of the product
Section 3: Conguration of the Product
The El-O-Matic F-Series are pneumatically operated actuators designed to operate Ball /
Plug / Buttery valves, automation of louvers and dampers & automation of any
quarter-turn mechanism. Both the double-acting and single-acting (spring-return) versions
of the El-O-Matic F-Series pneumatic actuators are designed in such a way that there are
no moving parts on the outside (with the exception of the position indicator). This makes
them safe, easy to install and virtually maintenance free.
For further details about actuator congurations, please refer to the El-O-Matic F-Series
product data sheets, Safety guide and Installation, Operation and Maintenance manual.
Section 3: Configuration of the product

4
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1 September 2018
Service Condition Limitations (Limitation of Use)
Section 4: Service Condition Limitations
(Limitation of Use)
The operating capabilities are listed below:
• Maximum Operating Pressure:
– Pneumatic Service
– Up to 120 psig (8.3 barg)
• Ambient Temperature:
Temperature extremes require different solutions to maintain actuator operational
integrity and reliability. For each El-O-Matic F-Series actuator is available in three
different temperature executions.
– -20°C to +80°C (-4°F to +176°F) Standard temperature
– -10°C to +120°C (+14°F to +250°F) High Temperature
– -40°C to +80°C (-40°F to +176°F) Low Temperature
• Torque Output Range:
– Double-Acting El-O-Matic F-Series actuators, requiring pressure to rotate
in either direction, are available with a torque range between 4.8 Nm
(44 lbf.in) and 6,490 Nm (59000 lbf.in)
– The El-O-Matic F-Series spring-return models require pressure in only one
direction of travel and are suitable for air-fail close and air-fail to open
applications without modication. These models are available with a
spring end torque between 2 Nm (20 lbf.in) and 2394 Nm (21000 lbf.in)
• Safety Function:
For spring-return models, the safety function is self-evident performed by the
springs. The safety function of double-acting models should be performed by the
A-chamber for safety related systems.
Figure 1 Use the A-Chamber for Safety Related Systems on Double-Acting Actuators
Assembly Code: CW Assembly Code: CC
= Safety Function is = Safety Function is
Counterclockwise Rotation Clockwise Rotation
AB
AB
A
B
A
B
PistonsPistons
Pinion
Section 4: Service Condition Limitations (Limitation of Use)

5
September 2018
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1
Service Condition Limitations (Limitation of Use)
• Use of manual override:
The use of a manual override is not recommended in a SIL classied application, as
it results in a bypass of the safety function. In case the manual override is used, the
following requirements must be fullled, or the Functional Safety Certication will
become invalid:
– The manual override shall be protected to prevent unauthorized use.
(e.g. by key locks in conjunction with effective management controls.).
– The users authorized to operate on the actuator shall be skilled personnel;
– The maximum duration of the manual override shall be dened.
– If necessary, compensatory measures to allow the safe operation of the
process shall be dened (responsibility of the nal user).
• When test or bypass facilities are included in the SIS (safety integrated system),
they shall conform with the following:
– The SIS shall be designed in accordance with the maintenance and testing
requirements dened in the SRS (safety requirement specication).
– The operator shall be alerted to the bypass of any portion of the SIS via an
alarm or operating procedure.
Before selecting remote operating mode control of actuator, the manual override must be
disengaged according to the relevant Installation, Operation and Maintenance Manual.
The position selected (remote/automatic control or local /manual control) can be achieved
with a specic technical solution that does not allow to reach an intermediate position
lever’s and avoids unintentional activation.
The engagement of the manual override shall be signaled, at least locally, according to
IOM. As optional request from nal user, to determine if the manual override is engaged, an
electrical signal using contact switching can be provided to communicate the status to the
control room.
• Loss of utility:
For double acting congurations that on loss of utility (e.g., electrical power,
or pneumatic supply) does not fail to the safe state a system for detecting and
alarming of loss of utility and SIS circuit integrity shall be implemented. (e.g., end-
of-line monitoring, supply pressure measurement), and action taken according to
par. 11.3 of IEC. 61511-1.
Section 4: Service Condition Limitations (Limitation of Use)

6
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1 September 2018
Expected Lifetime
Section 5: Expected Lifetime
Actuator lifetime (for which failure rates indicated in Section 6 are ensured) strongly
depends on operating conditions.
For normal service conditions, EL-O-Matic F-Series actuators can be in good conditions
also after more than 10 years with planned minimum maintenance. Normal working life is
500.000 cycles. El-O-Matic F-Series carry a warranty period of:
• 18 months after delivery if properly stored in conditions that we declare or
• 12 months after installation on site.
Section 5: Expected Lifetime

7
September 2018
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1
Failure Modes and Estimated Failure Rates
Section 6: Failure Modes and Estimated
Failure Rates
Table 1. Failure Modes and Estimated Failure Rates – El-O-Matic F-Series Actuator
Configuration Safety Function λDU [1/h] λDD [1/h] λS [1/h]
F- No PST 1 2,55E-08 0,00E+00 0,00E+00
F - With PST 1 2,29E-09 2,.32E-08 0,00E+00
NOTE:
• No internal diagnostics is included in the product.
• The above failure rates are guaranteed:
- For the service conditions listed in Section 4.
- For the expected lifetime declared in Section 5.
- Considering the periodic test and maintenance included in Section 8.
The failure rates are determined performing a FMEDA based on the failure rates of
components taken from industrial databases (NPRD-2016/FMD97/2016, EXIDA E&MCRH
and NSWC-2011), integrated with eld feedback using the Bayesian statistical approach
mentioned in IEC 61508-2 Par. 7.4.4.3.3.
The system for reporting failures is based on eld feedback from end users, with:
- Identication of the claim/failure
- Root cause analysis to identify cause and responsibility of the failure
- Identication of the possible effect of the failure on the Safety Function
- Classication of the failure considering the failure categories of IEC 61508-2
(Safe, Dangerous, No Effect) Customer Service, Quality and Technical
Department are responsible for the procedure, according to the respective role.
Section 6: Failure Modes and Estimated Failure Rates

8
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1 September 2018
Installation and Site Acceptance Procedure
Section 7: Installation and Site
Acceptance Procedure
Any necessary installation and site acceptance procedures are discussed in the
EL-O-Matic F-Series actuators Installation, Operation and Maintenance manual.
The Installation, Operation and Maintenance manual denes exercising of the actuator
after installation and denes testing after maintenance.
Section 7: Installation and Site Acceptance Procedure

9
September 2018
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1
Periodic Test and Maintenance Requirements
Section 8: Periodic Test and
Maintenance Requirements
8.1 General
Please consider that the information in this paragraph are relevant only in regards of
Reliability Tests; please refer to the Installation, Operation and Maintenance manual for
detailed information about product maintenance, handling and storage. Diagnostic tests
may be made to increase the system reliability (Full-Stroke or Partial-Stroke Test). “On site”
tests depend on Project/Plant facilities requirements; however, a functional test must be
executed on site, prior actuator operation.
8.2 Full-Stroke Test
The “Full Stroke Test” (“On-line”) must be performed to satisfy the PFDAVG
(average probability of failure on demand) value.
The full test frequencies will be dened by the nal integrator in relation to the dened
PFDAVG to be achieved.
• Procedure:
– Operate the Actuator/Valve assembly for 2 complete open/close cycles
with complete closing of the valve.
– Verify the Correct performing of open – close manoeuvre and within the
required operating times (eg. check locally, or automatically via Logic
solver, the correct movement of the actuator/valve).
– Compare the results with the ones stored during SAT
(site acceptance test) activities.
– Record the test results in your company’s SIF
(safety instrumented function) database.
– Restore normal operation.
Considering the application of the above described Full Stroke Test procedure, the “Test
Coverage”, in case of automatic procedure, can be considered > 99%.
In case of manual procedure the “Test Coverage” shall take into account also the test
imperfection and the reliability/competence of the operator.
Section 8: Periodic Test and Maintenance Requirements

10
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1 September 2018
Periodic Test and Maintenance Requirements
NOTE:
• If the test is automatic, then the Test Coverage is PTC (proof test coverage), but can
also considered as DC (diagnostic coverage).
• If the test is manual, then the Test Coverage is PTC, but cannot be considered as DC.
The procedure can be performed manually or automatically. In the following,
for both cases, the following points are listed:
• Parameters to be measured
• Instruments to be used
• Failure modes detected
• Diagnostic Coverage/Proof Test Coverage
Parameters to be measured:
The following parameters have to be measured for an effective Full Stroke Test:
• Angular position of the shaft;
• Time necessary to reach to nal position;
• Output torque (as indirect measure, by means of the of pressure measurement in the
cylinder chamber)
NOTE:
Not all parameters are needed, but the following combinations can be used:
1. Measurement of angular position as function of time
(pressure measurement is optional)
2. Measurement of cylinder chamber pressure as function of time
3. Verication of nal position achievement in the established maximum time.
Section 8: Periodic Test and Maintenance Requirements

11
September 2018
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1
Periodic Test and Maintenance Requirements
Table 2. Instruments/equipment to be used for the test
Quantity Instruments/equipment
Automatic Procedure Manual Procedure
Angular position of
the shaft
Case A
Use of a Logic Solver:
1. Limit switches box, or 4÷20 mA
position transmitter
2. Digital Input Module / Analog Input
Module included in the Logic Solver
3. Application Software function
(to compare the actual trend with the
one stored during SAT)
Case B
Use of a Partial stroke testing device:
1. Limit switches box, or 4÷20 mA
position transmitter
2. Partial stroke testing device with
integrated Software function
1. Limit switches box, and/or
visual indication
2. Skilled and trained
personnel
Time necessary
to reach the nal
position
As above
1. Limit switches box, and/or
visual indication
2. Chronometer
3. Skilled and trained
personnel
Output torque
(Pressure in the
cylinder)
Case A
Use of a Logic Solver:
1. Pressure transmitter connected to
the cylinder chamber
2. Analog Input Module included in
the Logic Solver
3. Application Software function
(to compare the actual trend with the
one stored during SAT)
Case B
Use of a Partial stroke testing device:
1. Pressure transmitter connected to
the cylinder chamber
2. Partial stroke testing device with inte-
grate Software function
Skilled and trained
personnel (to check audible
partial sticking)
Table 3. Failure mode detectable by the test
Component Detectable failure modes
Automatic Procedure Manual Procedure
Housing Breakage
As per automatic procedure
End cap Breakage
Piston Breakage
Sticking
Rack Breakage
Binding
Pinion Breakage
Binding
Spring Breakage
Weakened
Stroke adjustment Breakage
Bended
Section 8: Periodic Test and Maintenance Requirements

12
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1 September 2018
Periodic Test and Maintenance Requirements
NOTE:
• The ones listed above are the major failure modes of the main components
• In case of manual procedure, the detectable failure modes are the same as per
automatic procedure. The test coverage is lower than the one for automatic mode,
due to the human factor.
• The manual procedure cannot be considered as diagnostic.
8.3 Partial-Stroke Test
The “Partial Stroke Test” (“On-line”) can be performed to improve the PFDAVG value.
For the execution of a partial stoke test the actuator performs a partial open-close cycle
operation, typically a 15-25 degrees rotation of the valve, in order to check the correct
functioning of the actuator and the correct movement of the valve (not sticking and able
to move).
The “Partial Stroke Test” (“On line”) can be performed to satisfy PFDAVG (average probability
of failure on demand) value.
• Recommended Test Interval = 1 to 3 months.
• Procedure:
– Operate the actuator to perform N°2 partial open/close cycles, to verify
the correct functioning of the actuator/valve assembly;
– Verify that the partial stroke manoeuvre was performed correctly and
within the expected time;
– Verify the Correct performing of partial stroke operation and within the
expected time; (eg. check locally, or automatically via Logic solver, or via
the Partial stroke testing system the correct movement of the actuator/
valve assembly)
– Inspect the actuator components for any leakages (internal and external).
• The procedure can be performed manually or automatically. In the following, for
both cases, the following points are listed:
– Parameters to be measured
– Instruments to be used
– Failure modes detected
– Diagnostic Coverage/Proof Test Coverage
The above parameters to check will depend from the partial stroke test system available.
Considering the application of the above described Partial Stroke Test procedure,
the “Diagnostic Coverage” is >90 %.
In case of manual procedure the “Test Coverage” shall take into account also the test
imperfection and the reliability/competence of the operator.
Section 8: Periodic Test and Maintenance Requirements

13
September 2018
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1
Periodic Test and Maintenance Requirements
NOTE:
• If the test is automatic, then the Test Coverage can also considered as DC.
• If the test is manual, then the Test Coverage cannot be considered as DC.
Parameters to be measured:
The following parameters have to be measured for an effective Partial Stroke Test:
• Angular position of the shaft;
• Time necessary to reach to nal position;
• Output torque (as indirect measure, by means of the of pressure measurement in the
cylinder chamber)
NOTE:
Not all parameters are needed, but the following combinations can be used:
1. Measurement of angular position as function of time
(pressure measurement is optional).
2. Measurement of cylinder chamber pressure as function of time.
3. Verication of nal position achievement in the established maximum time.
The parameters to be measured depend upon the partial stroke test system available.
Instruments / equipment to be used for the test:
The Partial Stroke Test can be executed in the following way:
1. Using commercial Partial stroke testing device, measuring/verifying:
a. Measurement of angular position as function of time.
b. Measurement of cylinder chamber pressure as function of time (optional).
c. Verication of nal position achievement in the established maximum time.
2. By means of Logic Solver, measuring/verifying:
a. Measurement of angular position as function of time.
b. Measurement of cylinder chamber pressure as function of time (optional).
c. Verication of nal position achievement in the established maximum time.
Section 8: Periodic Test and Maintenance Requirements

14
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1 September 2018
Periodic Test and Maintenance Requirements
Table 4. Instruments/equipment to be used for the test
Quantity Instruments/equipment
Automatic Procedure Manual Procedure
Angular position of
the shaft
Case A
Use of a Logic Solver:
1. Limit switches box, or 4÷20 mA
position transmitter
2. Digital Input Module / Analog Input
Module included in the Logic Solver
3. Application Software function
(to compare the actual trend with the
one stored during SAT)
Case B
Use of a Partial stroke testing device:
1. Limit switches box, or 4÷20 mA
position transmitter
2. Partial stroke testing device with
integrated Software function
1. Limit switches box, and/or
visual indication
2. Skilled and trained
personnel
Time necessary
to reach the nal
position
As above
1. Limit switches box, and/or
visual indication
2. Chronometer
3. Skilled and trained
personnel
Output torque
(Pressure in the
cylinder)
Case A
Use of a Logic Solver:
1. Pressure transmitter connected to
the cylinder chamber
2. Analog Input Module included in
the Logic Solver
3. Application Software function
(to compare the actual trend with the
one stored during SAT)
Case B
Use of a Partial stroke testing device:
1. Pressure transmitter connected to
the cylinder chamber
2. Partial stroke testing device with inte-
grate Software function
Skilled and trained
personnel (to check audible
partial sticking)
Table 5. Failure mode detectable by the test
Component Detectable failure modes
Automatic Procedure Manual Procedure
Housing Breakage
As per automatic procedure
End cap Breakage
Piston Breakage
Sticking
Rack Breakage
Binding
Pinion Breakage
Binding
Spring Breakage
Weakened
Stroke adjustment Breakage
Bended
Section 8: Periodic Test and Maintenance Requirements

15
September 2018
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1
Periodic Test and Maintenance Requirements
NOTE:
• The ones listed above are the major failure modes of the main components
• In case of manual procedure, the detectable failure modes are the same as per
automatic procedure. The test coverage is lower than the one for automatic mode,
due to the human factor.
• The manual procedure cannot be considered as diagnostic. The test can be
considered as “non-perfect Proof Test”, and can be considered in the estimation of
PFDAVG, while it is not considered for the estimation of the SFF (safe failure fraction).
8.4 Proof Test and Periodic Maintenance
We advise to perform the following checks upon each proof test interval complying with
the rules and regulations of the country of nal installation:
• Visually check the entire valve operating system.
• Ensure there are no leaks on the pressurized parts.
• Check pneumatic connections for leaks. Tighten tube ttings as required.
• Check if manual override (where foreseen) is regular.
• Check if pneumatic lter cartridge (where foreseen) is sound and lter bowl (where
foreseen) has been cleaned properly.
• Check the setting of the relief valves (where foreseen).
• Verify that the power uid supply pressure value is within the required range.
• Remove built-up dust and dirt from all actuator surfaces.
• Inspect actuator paint work for damages to ensure continued corrosion
protection. Touch-up as required in accordance with the applicable paint
specication.
• Operate the Actuator/Valve assembly for 2 open/close complete cycles with
complete closing of the valve.
• Verify the correct performing of open – close operations (for example, check
locally, or automatically via Logic solver, the correct movement of the actuator).
The Installation, Operation and Maintenance manual denes a minimum maintenance
interval after 500.000 cycles for the El-O-Matic F-series actuators. This addresses
components that may have age related degradation. When the maintenance interval has
elapsed a complete overhaul of the actuator is required.
Section 8: Periodic Test and Maintenance Requirements

16
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1 September 2018
Architectural Constraints
Section 9: Architectural Constraints
For the evaluation of the conformity to the requirement of Hardware safety integrity
architectural constraints of the standard IEC 61508, both Route 1Hand Route 2Hare used.
Route 1H
• The product has a single channel conguration, HFT (hardware fault tolerance)=0
• Safe failure rate λS:
– Single Acting Actuators: According to IEC 65108 denitions (in particular
denitions 3.6.8 and 3.6.13 of IEC 61508-4), no Safe Failures are possible
in a Single Acting actuator. Each failure mode of the actuator itself shall be
classied as “Dangerous” or “No Effect” (failures which can generate the
spurious operation of the safety function are only external to the actuator
itself, or are related to components that “plays no part in implementing
the safety function”, e.g. components of the pneumatic cylinder.
Therefore, according to denition 3.6.13 of IEC 61508- 4, they cannot be
used for the calculation of the SFF.
Hence λS=0 for each type of single acting actuator.
– Double Acting Actuators: According to IEC 65108 denitions (in particular
denitions 3.6.8 and 3.6.13 of IEC 61508-4), no Safe Failures are possible
in a Double Acting actuator. Each failure mode of the actuator itself shall
be classied as “Dangerous” or “No Effect” (failures which can generate
the spurious operation of the safety function are only external to the
actuator itself, and in the case of loss of power supply the actuator “stays
put”). Therefore, according to denition 3.6.13 of IEC 61508- 4, they
cannot be used for the calculation of the SFF.
Hence λS=0 for each type of Double Acting actuator.
For this reason, according to denition 3.6.15 of IEC 61508-4, we have:
• SFF=0 without external diagnostic tests;
• SFF>0 with external diagnostic tests, carried out according to denition 3.8.7 of IEC
61508-4, and according to what written in Section 6 above
(see the same paragraph for the SFF / DC reachable).
Route 2H
• The application of Route 2H (“eld feedback”) is assessed.
• As the product is classied as “Type A”, no requirements for SFF are
given for Route 2H.
In conclusion:
The product can be used in single channel conguration up to:
• SIL 2 without external diagnostic tests
• SIL 3 considering external diagnostic tests
Section 9: Architectural Contraints

17
September 2018
SIL Safety Manual
DOC.SILM.EF.EN Rev. 1
Common Cause Factors
Section 10: Common Cause Factors
The product has a single channel conguration, HFT=0.
The βfactors can be used when performing PFDAVG calculations for redundant
architectures.
The Common Cause factors, relevant when the product is used in redundant conguration,
are: β=βD=0,05
NOTE:
• The above value is the value for 1oo2 architecture. The values for other architectures
shall be calculated according to IEC 61508 Part 6, Table D.5.
• The above value is calculated in the hypothesis of redundancy without diversity.
Section 10: Common Cause Factors