GMI D5290S-078 Instruction Manual

D5290S-078 - 5 A SIL 3 Relay Output Module G.M. International ISM0152-8
5 A SIL 3 Relay Output Module for NE or ND Loads,
with NE or ND Relay condition,
DIN-Rail and Termination Board,
Model D5290S-078
D5290S-078
INSTRUCTION & SAFETY MANUAL

2 D5290S-078 - 5 A SIL 3 Relay Output Module G.M. International ISM0152-8
0.20.1
V (V)
I (A)
10
20
30
40
50
100
200
300
0.3 0.5 1 2 3
Resistive
Load
45
250
Technical Data
Characteristics
Input: 24 Vdc nom (21.6 to 27.6 Vdc) reverse polarity protected, ripple within voltage limits ≤5 Vpp.
The following monitoring circuits are mutually exclusive:
1) Line input monitoring (DIP-Switch selectable): to allow DCS/PLC line monitoring function (pulse test).
2) Voltage monitoring (DIP-Switch selectable): ≥21.6 Vdc for normal operation, ≤17 Vdc reflects a high impedance (≤10 mA consumption) to the control device.
3) Short circuit fault detection (DIP-Switch selectable and only for Functional
Safety applications with NE Relay condition): to allow DCS/PLC to detect short circuit fault of module.
Current consumption @ 24 V: 60 mA with relay energized, typical.
Power dissipation: 1.5 W with 24 V input voltage, relay energized, typical.
Isolation (Test Voltage): Input / All Outputs: 2.5 KV; Out S_1 & Out P_1 / Out S_3 & Out P_2, Out S_2, Out S_4: 500 V;
Out S_3 & Out P_2 / Out S_2, Out S_4: 500 V; Out S_2 / Out S_4: 500 V.
Output: 2 voltage free SPDT (= NO contact + parallel of 2 NC contacts) relay contacts identified with outputs: Out S_1 & Out P_1 and Out S_3 & Out P_2;
2 voltage free SPST (NO) relay contacts identified with: Out S_2 and Out S_4.
Terminals 13-14 (Out S_1), 15-16 (Out S_2), 21-22 (Out S_4) and 23-24 (Out S_3) are: open when relay is de-energized, closed in energized relay condition.
Terminals 17-18 (Out P_1) and 19-20 (Out P_2) are: closed when relay is de-energized, open in energized relay condition.
Contact material: Ag Alloy (Cd free) or AgSnO2.
Contact rating: 5 A 250 Vac 1250 VA, 5 A 250 Vdc 175 W (resistive load).
Contact inrush current: 8 A at 30 Vdc, 250 Vac.
DC Load breaking capacity:
Mechanical / Electrical life: 10 * 106/ 5 * 104operation, typical.
Bounce time NO / NC contact: 4 / 10 ms, typical.
Frequency response: 10 Hz maximum.
Compatibility:
CE mark compliant, conforms to Directive:
2014/34/EU ATEX, 2014/30/EU EMC, 2014/35/EU LVD, 2011/65/EU RoHS.
Environmental conditions:
Operating: temperature limits - 40 to + 60 °C, relative humidity 95 %, up to 55 °C.
Storage: temperature limits - 45 to + 80 °C.
Safety Description:
ATEX: II 3G Ex nA nC IIC T4 Gc
IECEx / INMETRO / NEPSI: Ex nA nC IIC T4 Gc
FM: NI / I / 2 / ABCD / T4, I / 2 / AEx nA nC / IIC / T4
FMC: NI / I / 2 / ABCD / T4, I / 2 / Ex nA nC / IIC / T4
EAC-EX: 2ExnAnCIICT4 X.
UKR TR n. 898: 2ExnAnCIICT4 X.
non-sparking electrical equipment. -40 °C ≤Ta ≤60 °C.
Approvals:
BVS 10 ATEX E 114 conforms to EN60079-0, EN60079-15,
IECEx BVS 10.0072 X conforms to IEC60079-0, IEC60079-15.
INMETRO DNV 13.0109 X conforms to ABNT NBR IEC60079-0, ABNT NBR IEC60079-15.
UL & C-UL E477485 conforms to ANSI/UL508
FM 3046304 and FMC 3046304C conforms to Class 3600, 3611, 3810,
ANSI/ISA-60079-0, ANSI/ISA-60079-15, C22.2 No.142, C22.2 No.213, C22.2 No. 60079-0, C22.2 No. 60079-15.
C-IT.ME92.B.00206 conforms to GOST 30852.0, 30852.14.
CЦ16.0036 X conforms to ДСТУ 7113, ДСТУ IЕС 60079-15.
GYJ14.1406X conforms to GB3836.1, GB3836.8.
TUV Certificate No. C-IS-224248-01, SIL 2 / SIL 3 conforms to IEC61508:2010 Ed. 2.
TÜV Certificate No. C-IS-236198-09, SIL 3 Functional Safety Certificate conforms to IEC61508:2010 Ed.2, for Management of Functional Safety.
DNV No.A-13625 and KR No. MIL20769-EL002 Certificates for maritime applications.
Mounting:
T35 DIN-Rail according to EN50022 or on customized Termination Board.
Weight: about 145 g.
Connection: by polarized plug-in disconnect screw terminal blocks to accomodate terminations up to 2.5 mm2.
Location: installation in Safe Area/Non Hazardous Locations or Zone 2, Group IIC T4 or Class I, Division 2, Group A,B,C,D, T4 or Class I, Zone 2, Group IIC, T4.
Protection class: IP 20.
Dimensions: Width 22.5 mm, Depth 123 mm, Height 120 mm.
General Description:
The D5290S-078 is a relay module suitable for the switching of safety related circuits, up to SIL 3 level according to IEC 61508:2010 Ed. 2 for high risk industries.
It provides isolation between input channel and output contacts.
Three mutually exclusive (by DIP-Switch programming) monitoring circuits are provided:
1) line input monitoring, to allow DCS/PLC line monitoring function: when enabled, the module permits a wide compatibility towards different DCS/PLC. Driving line pulse
testing, executed by DCS/PLC, is permitted by a dedicated internal circuit, to prevent relay and LED flickering.
2) low voltage input monitoring: when enabled, the module reflects a high impedance state to the control unit when the driving voltage is below the specified threshold.
3) short circuit fault detection (only for Functional Safety applications with NE Relay condition): when enabled, it allows DCS/PLC to detect short circuit fault of module.
See the following pages for Functional Safety applications with related SIL value.
Mounting on standard DIN-Rail or on customized Termination Boards, in Safe Area / Non Hazardous Location or in Zone 2 / Class I, Division 2 or Class I, Zone 2.
Functional Safety Management Certification:
G.M. International is certified by TUV to conform to IEC61508:2010 part 1 clauses 5-6 for safety related systems up to and included SIL3.
FSM
SIL 3

3
D5290S-078 - 5 A SIL 3 Relay Output ModuleG.M. International ISM0152-8
Ordering Information
Front Panel and Features
SIL 3 according to IEC 61508:2010 for Tproof = 10 / 20 years (≤10% / >10 % of total SIF) with PFDavg (1 year) 7.01 E-06,
SFF = 99.17 % for two NE loads (see application n° 1, 2) or two ND loads (see application n° 4) with NE relay condition.
SIL 2 according to IEC 61508:2010 for Tproof = 7 / 20 years (≤10% / >10 % of total SIF) with PFDavg (1 year) 1.40 E-04,
SFF = 66.61 % for four NE loads with NE relay condition (see application n° 3).
SIL 3 according to IEC 61508:2010 for Tproof = 6 / 20 years (≤10% / >10 % of total SIF) with PFDavg (1 year) 1.58 E-05,
SFF = 98.81 % for a ND load with ND relay condition (see application n° 5).
SIL 2 according to IEC 61508:2010 for Tproof = 20 yrs (≤10% of total SIF) with PFDavg (1 year) 1.54 E-05,
SFF = 98.28 % for two ND loads with ND relay condition (see application n° 6).
Systematic capability SIL 3.
Installation in Zone 2 / Division 2.
5 A SIL 3 / SIL 2 contacts for NE or ND loads with NE or ND Relay condition.
8 A inrush current at 30 Vdc / 250 Vac.
Line input monitoring in-field DIP Switch selectable.
Driving input voltage monitoring.
Input/Output isolation.
EMC Compatibility to EN61000-6-2, EN61000-6-4, EN61326-1, EN61326-3-1 for safety system.
ATEX, IECEx, FM, FMC, EAC-EX, TÜV Certifications.
TÜV Functional Safety Certification.
Type Approval Certificate DNV and KR for maritime applications.
Simplified installation using standard DIN-Rail and plug-in terminal blocks or customized Termination Boards.
Model: D5290S-078 DIN-Rail accessories: Cover and fix MCHP196
Normally Open (NO) contact (Out S_1)
Terminal block connections
SAFE AREA
13
4 3 2 1
13 14 15 16
17 18 19 20
21 22 23 24
14
15
16
17
18
19
20
21
22
23
24
1Input +
2Input -
3Input +
4Input -
Normally Open (NO) contact (Out S_2)
Normally Closed (NC) contact (Out P_1)
Normally Closed (NC) contact (Out P_2)
Normally Open (NO) contact (Out S_4)
Normally Open (NO) contact (Out S_3)

4 D5290S-078 - 5 A SIL 3 Relay Output Module G.M. International ISM0152-8
Functional Safety Manual and Applications
Function Diagram
SAFE AREA, ZONE 2 GROUP IIC T4,
NON HAZARDOUS LOCATIONS, CLASS I, DIVISION 2,
GROUPS A, B, C, D T-Code T4, CLASS I, ZONE 2, GROUP IIC T4
MODEL D5290S-078
+In
1
2
3
4
Termination
board
connector
22
21
19
20
23
24
Out S_1 (NO contact)
13
14
Out P_1 (NC contact)
17
18
16
15
Out S_2 (NO contact)
Out S_4 (NO contact)
Out P_2 (NC contact)
Out S_3 (NO contact)
To prevent relay contacts from damaging, connect an external protection (fuse or similar),
chosen according to the relay breaking capacity diagram.
Relay contacts shown in de-energized position.
Terminals 13-14, 15-16, 21-22 and 23-24 are open.
Terminals 17-18 and 19-20 are closed.
See the following pages for Functional Safety applications with related SIL value.

5
D5290S-078 - 5 A SIL 3 Relay Output ModuleG.M. International ISM0152-8
Functional Safety Manual and Applications
22
21
20
23
24-19
18-13
17
14
Application D5290S-078 - SIL 3 Load Normally Energized Condition (NE) and Normally Energized Relay:
one common driving signal from PLC for both NE loads (A and B), with interruption of both load supply lines
B
NE
Load
SIL 3
PLC
Output ON
24 Vdc
Normal state operation De-energized to trip operation
Service
Load B
(Not SIL)
A NE
Load
SIL 3
16
15
Service
Load A
(Not SIL)
22
21
20
23
24-19
18-13
17
14
B
NE
Load
SIL 3
PLC
Output OFF
0 Vdc
Service
Load B
(Not SIL)
A NE
Load
SIL 3
16
15
Service
Load A
(Not SIL)
- / AC (for load A and its service load)
+ / AC (for load A and its service load) + / AC (for load B and its service load)
- / AC (for load B and its service load)
+ / AC (for load A and its service load) + / AC (for load B and its service load)
- / AC (for load A and its service load) - / AC (for load B and its service load)
1)
Input Signal
Pins 1-2 or 3-4
Pins
13-14
Pins
15-16
NE Load A (SIL3)
Pins 14-16
NE Load B (SIL 3)
Pins 23-21
Service
Load A
High (24 Vdc) Closed Closed Energized Energized De-Energized
Low (0 Vdc) Open Open De-Energized De-Energized Energized
Service
Load B
De-Energized
Energized
Pins
23-24
Closed
Open
Pins
21-22
Closed
Open
Operation
Normal
Trip
Pins
17-18
Open
Closed
Pins
19-20
Open
Closed
Description:
Input Signal from PLC/DCS is normally High (24 Vdc) and is applied to pins 1-2 or 3-4 in order to Normally Energize (NE) the internal relays.
Input Signal from PLC/DCS is Low (0 Vdc) during “de-energize to trip” operation, in order de-energize the internal relays.
Load A (and Load B if present) is Normally Energized (NE) therefore its safe state is to be de-energized.
Disconnection of Loads A and B is done on both supply lines.
Service Load A (and Service Load B if present) is normally de-energized, therefore it energizes during “de-energize to trip” operation.
The following table describes the status (open or closed) of each output contact when input signal is High or Low.
Safety Function and Failure behavior:
D5290S-078 is considered to be operating in Low Demand mode, as a Type A module, having Hardware Fault Tolerance (HFT) = 0.
In the 1st Functional Safety application, the normal state operation of relay module is energized, with NE (Normally Energized) loads.
In case of alarm or request from process, the relay module is de-energized (safe state), de-energizing loads.
The failure behaviour of relay module is described by the following definitions:
□fail-Safe State: it is defined as the output load being de-energized;
□fail Safe: this failure causes the system to go to the defined fail-safe state without a process demand;
□fail Dangerous: failure mode that does not respond to a demand from the process (i.e. being unable to go to the defined fail-safe state), so that the output load remains energized.
In addition, there are other definitions of failure behaviours which are not safety-related:
□fail “No effect”: failure mode of a component that plays a part in implementing the safety function but is neither a safe failure nor a dangerous failure;
□fail “Not part”: failure mode of a component which is not part of the safety function but part of the circuit diagram and is listed for completeness. When calculating the SFF this
failure mode is not taken into account. It is also not considered for the total failure rate evaluation.
Failure rate date: taken from Siemens Standard SN29500.
Failure rates table according to IEC 61508:2010 Ed.2 :
λsd λsu λdd λdu SFF
0.00 FIT 190.02 FIT 0.00 FIT 1.60 FIT 99.17%
PFDavg vs T[Proof] table (assuming Proof Test coverage of 99%), with determination of SIL supposing module contributes ≤10% of total SIF dangerous failures:
T[Proof] = 1 year T[Proof] = 10 years
PFDavg = 7.01 E-06 - Valid for SIL 3 PFDavg = 7.01 E-05 - Valid for SIL 3
PFDavg vs T[Proof] table (assuming Proof Test coverage of 99%), with determination of SIL supposing module contributes >10% of total SIF dangerous failures:
T[Proof] = 20 years
PFDavg = 1.40 E-04 - Valid for SIL 3
Failure rate table:
Failure category Failure rates (FIT)
λdd = Total Dangerous Detected failures 0.00
λdu = Total Dangerous Undetected failures 1.60
λsd = Total Safe Detected failures 0.00
λsu = Total Safe Undetected failures 190.02
λtot safe = Total Failure Rate (Safety Function) = λdd + λdu + λsd + λsu 191.62
λnot part = “Not Part” failures 0.60
λtot device = Total Failure Rate (Device) = λtot safe + λno effect + λnot part 284.60
MTBF (device, single channel) = (1 / λtot device) + MTTR (8 hours) 401 years
MTTFS(Total Safe) = 1 / (λsd + λsu) 600 years
MTTFD(Dangerous) = 1 / λdu 71347 years
λno effect = “No effect” failures 92.38
MTBF (safety function, single channel) = (1 / λtot safe) + MTTR (8 hours) 595 years
Systematic capability SIL 3.

6 D5290S-078 - 5 A SIL 3 Relay Output Module G.M. International ISM0152-8
Functional Safety Manual and Applications
22
21
20
23
24-19
18-13
17
14
Application D5290S-078 - SIL 3 Load Normally Energized Condition (NE) and Normally Energized Relay:
one common driving signal from PLC for both NE loads (A and B), with interruption of only one load supply line
B
NE
Load
SIL 3
PLC
Output ON
24 Vdc
Normal state operation De-energized to trip operation
Service
Load B
(Not SIL)
A NE
Load
SIL 3
16
15
Service
Load A
(Not SIL) 22
21
20
23
24-19
18-13
17
14
B
NE
Load
SIL 3
PLC
Output OFF
0 Vdc Service
Load B
(Not SIL)
A NE
Load
SIL 3
16
15
Service
Load A
(Not SIL)
+ / AC (for load A and its service load) + / AC (for load B and its service load) + / AC (for load A and its service load) + / AC (for load B and its service load)
- / AC (for load A and its service load) - / AC (for load B and its service load) - / AC (for load A and its service load) - / AC (for load B and its service load)
2)
Input Signal
Pins 1-2 or 3-4
Pins
13-14
Pins
15-16
NE Load A (SIL3)
Pins 15-Supply
NE Load B (SIL 3)
Pins 22-Supply
Service
Load A
High (24 Vdc) Closed Closed Energized Energized De-Energized
Low (0 Vdc) Open Open De-Energized De-Energized Energized
Service
Load B
De-Energized
Energized
Pins
23-24
Closed
Open
Pins
21-22
Closed
Open
Operation
Normal
Trip
Pins
17-18
Open
Closed
Pins
19-20
Open
Closed
Description:
Input Signal from PLC/DCS is normally High (24 Vdc) and is applied to pins 1-2 or 3-4 in order to Normally Energize (NE) the internal relays.
Input Signal from PLC/DCS is Low (0 Vdc) during “de-energize to trip” operation, in order de-energize the internal relays.
Load A (and Load B if present) is Normally Energized (NE) therefore its safe state is to be de-energized.
Disconnection of Loads A and B is done by disconnecting one supply line via two separate contacts.
Service Load A (and Service Load B if present) is normally de-energized, therefore it energizes during “de-energize to trip” operation.
The following table describes the status (open or closed) of each output contact when input signal is High or Low.
Safety Function and Failure behavior:
D5290S-078 is considered to be operating in Low Demand mode, as a Type A module, having Hardware Fault Tolerance (HFT) = 0.
In the 2nd Functional Safety application, the normal state operation of relay module is energized, with NE (Normally Energized) loads.
In case of alarm or request from process, the relay module is de-energized (safe state), de-energizing loads.
The failure behaviour of relay module is described by the following definitions:
□fail-Safe State: it is defined as the output load being de-energized;
□fail Safe: this failure causes the system to go to the defined fail-safe state without a process demand;
□fail Dangerous: failure mode that does not respond to a demand from the process (i.e. being unable to go to the defined fail-safe state), so that the output load remains energized.
In addition, there are other definitions of failure behaviours which are not safety-related:
□fail “No effect”: failure mode of a component that plays a part in implementing the safety function but is neither a safe failure nor a dangerous failure;
□fail “Not part”: failure mode of a component which is not part of the safety function but part of the circuit diagram and is listed for completeness. When calculating the SFF this
failure mode is not taken into account. It is also not considered for the total failure rate evaluation.
Failure rate date: taken from Siemens Standard SN29500.
Failure rates table according to IEC 61508:2010 Ed.2 :
λsd λsu λdd λdu SFF
0.00 FIT 190.02 FIT 0.00 FIT 1.60 FIT 99.17%
PFDavg vs T[Proof] table (assuming Proof Test coverage of 99%), with determination of SIL supposing module contributes ≤10% of total SIF dangerous failures:
T[Proof] = 1 year T[Proof] = 10 years
PFDavg = 7.01 E-06 - Valid for SIL 3 PFDavg = 7.01 E-05 - Valid for SIL 3
PFDavg vs T[Proof] table (assuming Proof Test coverage of 99%), with determination of SIL supposing module contributes >10% of total SIF dangerous failures:
T[Proof] = 20 years
PFDavg = 1.40 E-04 - Valid for SIL 3
Failure rate table:
Failure category Failure rates (FIT)
λdd = Total Dangerous Detected failures 0.00
λdu = Total Dangerous Undetected failures 1.60
λsd = Total Safe Detected failures 0.00
λsu = Total Safe Undetected failures 190.02
λtot safe = Total Failure Rate (Safety Function) = λdd + λdu + λsd + λsu 191.62
λnot part = “Not Part” failures 0.60
λtot device = Total Failure Rate (Device) = λtot safe + λno effect + λnot part 284.60
MTBF (device, single channel) = (1 / λtot device) + MTTR (8 hours) 401 years
MTTFS(Total Safe) = 1 / (λsd + λsu) 600 years
MTTFD(Dangerous) = 1 / λdu 71347 years
λno effect = “No effect” failures 92.38
MTBF (safety function, single channel) = (1 / λtot safe) + MTTR (8 hours) 595 years
Systematic capability SIL 3.

7
D5290S-078 - 5 A SIL 3 Relay Output ModuleG.M. International ISM0152-8
Functional Safety Manual and Applications
22
21
20
23
24-19
18-13
17
14
Application D5290S-078 - SIL 2 Load Normally Energized Condition (NE) and Normally Energized Relay:
one common driving signal from PLC for all NE loads (A, B, C and D), with interruption of only one load supply line
D
NE
Load
SIL 2
PLC
Output ON
24 Vdc
Normal state operation De-energized to trip operation
Service
Load B
(Not SIL)
A NE
Load
SIL 2
16
15
Service
Load A
(Not SIL)
C NE
Load
SIL 2
B
NE
Load
SIL 2
+ / AC (for load C) + / AC (for load B
and its service
load)
+ / AC (for load D)
- / AC (for load C) - / AC (for load D)
- / AC
(for load A and
its service load)
- / AC
(for load B and
its service load)
22
21
20
23
24-19
18-13
17
14
D
NE
Load
SIL 2
PLC
Output OFF
0 Vdc
Service
Load B
(Not SIL)
A NE
Load
SIL 2
16
15
Service
Load A
(Not SIL)
C NE
Load
SIL 2
B
NE
Load
SIL 2
+ / AC
(for load A
and service
load A)
+ / AC (for load C) + / AC (for load B
and its service
load)
+ / AC (for load D)
- / AC (for load C) - / AC (for load D)
- / AC
(for load A and
its service load)
- / AC
(for load B and
its service load)
3)
Input Signal
Pins 1-2 or 3-4
Pins
13-14
Pins
15-16
NE Load A
(SIL 2)
Pins 14-Supply
NE Load C
(SIL 2)
Pins 16-Supply
Service
Load A
High (24 Vdc) Closed Closed Energized Energized De-Energized
Low (0 Vdc) Open Open De-Energized De-Energized Energized
Service
Load B
De-Energized
Energized
Pins
21-22
Closed
Open
Pins
23-24
Closed
Open
Operation
Normal
Trip
Pins
17-18
Open
Closed
Pins
19-20
Open
Closed
NE Load B
(SIL 2)
Pins 23-Supply
Energized
De-Energized
NE Load D
(SIL 2)
Pins 21-Supply
Energized
De-Energized
Description:
Input Signal from PLC/DCS is normally High (24 Vdc) and is applied to pins 1-2 or 3-4 in order to Normally Energize (NE) the internal relays.
Input Signal from PLC/DCS is Low (0 Vdc) during “de-energize to trip” operation, in order de-energize the internal relays.
Load A (and Load B, C, D if present) is Normally Energized (NE) therefore its safe state is to be de-energized.
Disconnection of Loads A, B, C, D is done by disconnecting one supply line.
Service Load A (and Service Load B if present) is normally de-energized, therefore it energizes during “de-energize to trip” operation.
The following table describes the status (open or closed) of each output contact when input signal is High or Low.
Safety Function and Failure behavior:
D5290S-078 is considered to be operating in Low Demand mode, as a Type A module, having Hardware Fault Tolerance (HFT) = 0.
In the 3rd Functional Safety application, the normal state operation of relay module is energized, with NE (Normally Energized) loads.
In case of alarm or request from process, the relay module is de-energized (safe state), de-energizing loads.
The failure behaviour of relay module is described by the following definitions:
□fail-Safe State: it is defined as the output load being de-energized;
□fail Safe: this failure causes the system to go to the defined fail-safe state without a process demand;
□fail Dangerous: failure mode that does not respond to a demand from the process (i.e. being unable to go to the defined fail-safe state), so that the output load remains energized.
In addition, there are other definitions of failure behaviours which are not safety-related:
□fail “No effect”: failure mode of a component that plays a part in implementing the safety function but is neither a safe failure nor a dangerous failure;
□fail “Not part”: failure mode of a component which is not part of the safety function but part of the circuit diagram and is listed for completeness. When calculating the SFF this
failure mode is not taken into account. It is also not considered for the total failure rate evaluation.
Failure rate date: taken from Siemens Standard SN29500.
+ / AC
(for load A
and service
load A)
Failure rates table according to IEC 61508:2010 Ed.2 :
λsd λsu λdd λdu SFF
0.00 FIT 63.84 FIT 0.00 FIT 32.00 FIT 66.61%
PFDavg vs T[Proof] table (assuming Proof Test coverage of 99%), with determination of SIL supposing module contributes ≤10% of total SIF dangerous failures:
T[Proof] = 1 year T[Proof] = 7 years
PFDavg = 1.40 E-04 - Valid for SIL 2 PFDavg = 9.81 E-04 - Valid for SIL 2
PFDavg vs T[Proof] table (assuming Proof Test coverage of 99%), with determination of SIL supposing module contributes >10% of total SIF dangerous failures:
Failure rate table:
Failure category Failure rates (FIT)
λdd = Total Dangerous Detected failures 0.00
λdu = Total Dangerous Undetected failures 32.00
λsd = Total Safe Detected failures 0.00
λsu = Total Safe Undetected failures 63.84
λtot safe = Total Failure Rate (Safety Function) = λdd + λdu + λsd + λsu 95.84
λnot part = “Not Part” failures 0.60
λtot device = Total Failure Rate (Device) = λtot safe + λno effect + λnot part 166.60
MTBF (device, single channel) = (1 / λtot device) + MTTR (8 hours) 685 years
MTTFS(Total Safe) = 1 / (λsd + λsu) 1788 years
MTTFD(Dangerous) = 1 / λdu 3567 years
λno effect = “No effect” failures 70.16
MTBF (safety function, single channel) = (1 / λtot safe) + MTTR (8 hours) 1191 years
T[Proof] = 20 years
PFDavg = 2.80 E-03 - Valid for SIL 2
Systematic capability SIL 3.

8 D5290S-078 - 5 A SIL 3 Relay Output Module G.M. International ISM0152-8
Functional Safety Manual and Applications
20
23
24-19
18-13
17
14
Application D5290S-078 - SIL 3 Load Normally De-energized Condition (ND) and Normally Energized Relay:
one common driving signal from PLC for both ND loads (A and B), with interruption of only one load supply line
PLC
Output ON
24 Vdc
B
Normal state operation De-Energize to trip operation
Service
Load B
(Not SIL)
ND
Load
SIL 3
A Service
Load A
(Not SIL)
ND
Load
SIL 3
20
23
24-19
18-13
17
14
PLC
Output OFF
0 Vdc
B
Service
Load B
(Not SIL)
ND
Load
SIL 3
A Service
Load A
(Not SIL)
ND
Load
SIL 3
+ / AC (for load A and its service load) + / AC (for load B and its service load) + / AC (for load A and its service load) + / AC (for load B and its service load)
- / AC (for load A and its service load) - / AC (for load B and its service load) - / AC (for load A and its service load) - / AC (for load B and its service load)
4)
Operation Input Signal
Pins 1-2 or 3-4
Pins
17-18
Pins
19-20
ND Load A (SIL3)
Pins 17-Supply
ND Load B (SIL 3)
Pins 20-Supply
Pins
13-14
Pins
23-24
Service
Load A
Service
Load B
Normal High (24 Vdc) Open Open De-Energized De-Energized Closed Closed Energized Energized
Trip Low (0 Vdc) Closed Closed Energized Energized Open Open De-Energized De-Energized
Description:
Input Signal from PLC/DCS is normally High (24 Vdc) and is applied to pins 1-2 or 3-4 in order to Normally Energize (NE) the internal relays.
Input Signal from PLC/DCS is Low (0 Vdc) during “de-energize to trip” operation, in order de-energize the internal relays.
Load A (and Load B if present) is Normally De-Energized (ND) therefore its safe state is to be energized.
Disconnection of Loads A and B is done by disconnecting one supply line.
Service Load A (and Service Load B if present) is normally energized, therefore it de-energizes during “de-energize to trip” operation.
The following table describes the status (open or closed) of each output contact when input signal is High or Low.
Safety Function and Failure behavior:
D5290S-078 is considered to be operating in Low Demand mode, as a Type A module, having Hardware Fault Tolerance (HFT) = 0.
In the 4th Functional Safety application, the normal state operation of relay module is energized, with ND (Normally De-energized) loads.
In case of alarm or request from process, the relay module is de-energized (safe state), energizing loads.
The failure behaviour of all relay modules here considered is described by the following definitions:
□fail-Safe State: it is defined as the output load being energized;
□fail Safe: this failure causes the system to go to the defined fail-safe state without a process demand;
□fail Dangerous: failure mode that does not respond to a demand from the process (i.e. being unable to go to defined fail-safe state), so that output load remains de-energized.
In addition, there are other definitions of failure behaviours which are not safety-related:
□fail “No effect”: failure mode of a component that plays a part in implementing the safety function but is neither a safe failure nor a dangerous failure;
□fail “Not part”: failure mode of a component which is not part of the safety function but part of the circuit diagram and is listed for completeness. When calculating the SFF this
failure mode is not taken into account. It is also not considered for the total failure rate evaluation.
Failure rate date: taken from Siemens Standard SN29500.
Failure rates table according to IEC 61508:2010 Ed.2 :
λsd λsu λdd λdu SFF
0.00 FIT 190.02 FIT 0.00 FIT 1.60 FIT 99.17%
PFDavg vs T[Proof] table (assuming Proof Test coverage of 99%), with determination of SIL supposing module contributes ≤10% of total SIF dangerous failures:
T[Proof] = 1 year T[Proof] = 10 years
PFDavg = 7.01 E-06 - Valid for SIL 3 PFDavg = 7.01 E-05 - Valid for SIL 3
PFDavg vs T[Proof] table (assuming Proof Test coverage of 99%), with determination of SIL supposing module contributes >10% of total SIF dangerous failures:
T[Proof] = 20 years
PFDavg = 1.40 E-04 - Valid for SIL 3
Failure rate table:
Failure category Failure rates (FIT)
λdd = Total Dangerous Detected failures 0.00
λdu = Total Dangerous Undetected failures 1.60
λsd = Total Safe Detected failures 0.00
λsu = Total Safe Undetected failures 190.02
λtot safe = Total Failure Rate (Safety Function) = λdd + λdu + λsd + λsu 191.62
λnot part = “Not Part” failures 0.60
λtot device = Total Failure Rate (Device) = λtot safe + λno effect + λnot part 284.60
MTBF (device, single channel) = (1 / λtot device) + MTTR (8 hours) 401 years
MTTFS(Total Safe) = 1 / (λsd + λsu) 600 years
MTTFD(Dangerous) = 1 / λdu 71347 years
λno effect = “No effect” failures 92.38
MTBF (safety function, single channel) = (1 / λtot safe) + MTTR (8 hours) 595 years
Systematic capability SIL 3.

9
D5290S-078 - 5 A SIL 3 Relay Output ModuleG.M. International ISM0152-8
Functional Safety Manual and Applications
18-13 or 19-24
17 or 20
14 or 23
Application D5290S-078 - SIL 3 Load Normally De-energized Condition (ND) and Normally De-energized Relay,
with interruption of only one load supply line
PLC
Output OFF
0 Vdc
Normal state operation Energized to trip operation
ND
Load
SIL 3
16
15
Service
Load
(Not SIL)
+ / AC
- / AC
5)
21
22 18-13 or 19-24
17 or 20
14 or 23
PLC
Output ON
24 Vdc
ND
Load
SIL 3
16
15
Service
Load
(Not SIL)
+ / AC
- / AC
21
22
Operation Input Signal
Pins 1-2 or 3-4
Pins 13-14
or 23-24
Pins
15-16
Pins
21-22
ND Load (SIL 3)
Pins 14 (or 23),16,21-Supply
Pins 17-18
or 19-20
Service
Load
Normal Low (0 Vdc) Open Open Open De-Energized Closed Energized
Trip High (24 Vdc) Closed Closed Closed Energized Open De-Energized
Description:
Input Signal from PLC/DCS is normally Low (0 Vdc) and is applied to pins 1-2 or 3-4 in order to Normally De-energize (ND) the internal relays.
Input Signal from PLC/DCS is High (24 Vdc) during “energize to trip” operation, in order energize the internal relays.
Load is Normally De-Energized (ND) therefore its safe state is to be energized. Load is connected in parallel to pins 14 (or 23) and 16 and 21.
Disconnection of Load is done by disconnecting one supply line via three separate contacts in parallel.
Service Load is normally energized, therefore it de-energizes during “energize to trip” operation.
The following table describes the status (open or closed) of each output contact when input signal is High or Low.
Safety Function and Failure behavior:
D5290S-078 is considered to be operating in Low Demand mode, as a Type A module, having Hardware Fault Tolerance (HFT) = 0.
In the 5th Functional Safety application, the normal state operation of relay module is de-energized, with ND loads.
In case of alarm or request from process, the relay module is energized (safe state), energizing loads.
The failure behaviour of all relay modules here considered is described by the following definitions:
□fail-Safe State: it is defined as the output load being energized;
□fail Safe: this failure causes the system to go to the defined fail-safe state without a process demand;
□fail Dangerous: failure mode that does not respond to a demand from the process (i.e. being unable to go to defined fail-safe state), so that output load remains de-energized.
In addition, there are other definitions of failure behaviours which are not safety-related:
□fail “No effect”: failure mode of a component that plays a part in implementing the safety function but is neither a safe failure nor a dangerous failure;
□fail “Not part”: failure mode of a component which is not part of the safety function but part of the circuit diagram and is listed for completeness. When calculating the SFF this
failure mode is not taken into account. It is also not considered for the total failure rate evaluation.
Failure rate date: taken from Siemens Standard SN29500.
Failure rates table according to IEC 61508:2010 Ed.2 :
λsd λsu λdd λdu SFF
0.00 FIT 299.70 FIT 0.00 FIT 3.60 FIT 98.81%
PFDavg vs T[Proof] table (assuming Proof Test coverage of 99%), with determination of SIL supposing module contributes ≤10% of total SIF dangerous failures:
T[Proof] = 1 year T[Proof] = 6 years
PFDavg = 1.58 E-05 - Valid for SIL 3 PFDavg = 9.46 E-05 - Valid for SIL 3
PFDavg vs T[Proof] table (assuming Proof Test coverage of 99%), with determination of SIL supposing module contributes >10% of total SIF dangerous failures:
Failure rate table:
Failure category Failure rates (FIT)
λdd = Total Dangerous Detected failures 0.00
λdu = Total Dangerous Undetected failures 3.60
λsd = Total Safe Detected failures 0.00
λsu = Total Safe Undetected failures 299.70
λtot safe = Total Failure Rate (Safety Function) = λdd + λdu + λsd + λsu 303.30
λnot part = “Not Part” failures 0.00
λtot device = Total Failure Rate (Device) = λtot safe + λno effect + λnot part 402.60
MTBF (device, single channel) = (1 / λtot device) + MTTR (8 hours) 283 years
MTTFS(Total Safe) = 1 / (λsd + λsu) 380 years
MTTFD(Dangerous) = 1 / λdu 31709 years
λno effect = “No effect” failures 99.30
MTBF (safety function, single channel) = (1 / λtot safe) + MTTR (8 hours) 376 years
T[Proof] = 20 years
PFDavg = 3.15 E-04 - Valid for SIL 3
Systematic capability SIL 3.

10 D5290S-078 - 5 A SIL 3 Relay Output Module G.M. International ISM0152-8
Functional Safety Manual and Applications
18-13
17
14
Application D5290S-078 - SIL 2 Load Normally De-energized Condition (ND) and Normally De-energized Relay:
one common driving signal from PLC for both ND loads (A and B), with interruption of only one load supply line
PLC
Output OFF
0 Vdc
Normal state operation Energized to trip operation
A ND
Load
SIL 2
16
15
Service
Load A
(Not SIL)
24-19
20
23
B
ND
Load
SIL 2
21
22
Service
Load B
(Not SIL)
+ / AC (for load A and its service load) + / AC (for load B and its service load)
- / AC (for load A and its service load) - / AC (for load B and its service load)
18-13
17
14
PLC
Output ON
24 Vdc
A ND
Load
SIL 2
16
15
Service
Load A
(Not SIL)
24-19
20
23
B
ND
Load
SIL 2
21
22
Service
Load B
(Not SIL)
+ / AC (for load A and its service load) + / AC (for load B and its service load)
- / AC (for load A and its service load) - / AC (for load B and its service load)
6)
Operation Input Signal
Pins 1-2 or 3-4
Pins
13-14
Pins
15-16
ND Load A (SIL 2)
Pins 14,16-Supply
ND Load B (SIL 2)
Pins 21,23-Supply
Pins
17-18
Pins
19-20
Service
Load A
Service
Load B
Normal Low (0 Vdc) Open Open De-Energized De-Energized
Closed Closed Energized Energized
Trip High (24 Vdc) Closed Closed Energized Energized Open Open De-Energized De-Energized
Description:
Input Signal from PLC/DCS is normally Low (0 Vdc) and is applied to pins 1-2 or 3-4 in order to Normally De-energize (ND) the internal relays.
Input Signal from PLC/DCS is High (24 Vdc) during “energize to trip” operation, in order energize the internal relays.
Load A (and Load B if present) is Normally De-energized (ND) therefore its safe state is to be energized.
Disconnection of Loads A and B is done by disconnecting one supply line via two separate contacts in parallel.
Service Load A (and Service Load B if present) is normally energized, therefore it de-energizes during “energize to trip” operation.
The following table describes the status (open or closed) of each output contact when input signal is High or Low.
Safety Function and Failure behavior:
D5290S-078 is considered to be operating in Low Demand mode, as a Type A module, having Hardware Fault Tolerance (HFT) = 0.
In the 6th Functional Safety application, the normal state operation of relay module is de-energized, with ND loads.
In case of alarm or request from process, the relay module is energized (safe state), energizing loads.
The failure behaviour of all relay modules here considered is described by the following definitions:
□fail-Safe State: it is defined as the output load being energized;
□fail Safe: this failure causes the system to go to the defined fail-safe state without a process demand;
□fail Dangerous: failure mode that does not respond to a demand from the process (i.e. being unable to go to defined fail-safe state), so that output load remains de-energized.
In addition, there are other definitions of failure behaviours which are not safety-related:
□fail “No effect”: failure mode of a component that plays a part in implementing the safety function but is neither a safe failure nor a dangerous failure;
□fail “Not part”: failure mode of a component which is not part of the safety function but part of the circuit diagram and is listed for completeness. When calculating the SFF this
failure mode is not taken into account. It is also not considered for the total failure rate evaluation.
Failure rate date: taken from Siemens Standard SN29500.
Failure rates table according to IEC 61508:2010 Ed.2 :
λsd λsu λdd λdu SFF
0.00 FIT 200.68 FIT 0.00 FIT 3.52 FIT 98.28%
PFDavg vs T[Proof] table (assuming Proof Test coverage of 99%), with determination of SIL supposing module contributes ≤10% of total SIF dangerous failures:
T[Proof] = 1 year T[Proof] = 20 years
PFDavg = 1.54 E-05 - Valid for SIL 2 PFDavg = 3.08 E-04 - Valid for SIL 2
Failure rate table:
Failure category Failure rates (FIT)
λdd = Total Dangerous Detected failures 0.00
λdu = Total Dangerous Undetected failures 3.52
λsd = Total Safe Detected failures 0.00
λsu = Total Safe Undetected failures 200.68
λtot safe = Total Failure Rate (Safety Function) = λdd + λdu + λsd + λsu 204.20
λnot part = “Not Part” failures 0.00
λtot device = Total Failure Rate (Device) = λtot safe + λno effect + λnot part 284.60
MTBF (device, single channel) = (1 / λtot device) + MTTR (8 hours) 401 years
MTTFS(Total Safe) = 1 / (λsd + λsu) 568 years
MTTFD(Dangerous) = 1 / λdu 32430 years
λno effect = “No effect” failures 80.40
MTBF (safety function, single channel) = (1 / λtot safe) + MTTR (8 hours) 559 years
Systematic capability SIL 3.