MMT 230 Series User manual

ISO 9001
M . M . T . s.r.l. 26010 CAPRALBA (CR) - ITALY - Via degli Artigiani, 56 tel. [phone] - fax. [phone]
www.mmtitalia.com e-mail: [email protected]
Man_E_230_21y_0z_man_s2.8x_rev0_SIL3.doc
© 2005 –2008 M.M.T. Srl pag. 1/23
Instruction manual
Safety level switch
Low level
Series 230
v. 4.01
MMT srl
www.mmtitalia.com
Capralba (CR) - Italy
[Maggio 2023]

ISO 9001
M . M . T . s.r.l. 26010 CAPRALBA (CR) - ITALY - Via degli Artigiani, 56 tel. [phone] - fax. [phone]
www.mmtitalia.com e-mail: [email protected]
Man_E_230_21y_0z_man_s2.8x_rev0_SIL3.doc
© 2005 –2008 M.M.T. Srl pag. 2/23
Series 230 Instruction Manual
Index
1 - Description
2 - Technical characteristics of the level switch 230
3 - Technical characteristics of the probe 800
4 - General Safety information
4.1 - probe
4.2 - level switch
5 - Installation
5.1 - Mechanical assembly of the probe
5.2 - Level switch installation
5.3 - Electrical power supply
5.4 - Push buttons usage
5.5 - Wiring between the probe and the switch
5.6 - User’s wiring
6 - Operation
6.1 - Troubleshooting
6.2 - Example of connection
7 - Maintenance
8 - Disposal
9 - Accessories
Safety Manual - SIL

ISO 9001
M . M . T . s.r.l. 26010 CAPRALBA (CR) - ITALY - Via degli Artigiani, 56 tel. [phone] - fax. [phone]
www.mmtitalia.com e-mail: [email protected]
Man_E_230_21y_0z_man_s2.8x_rev0_SIL3.doc
© 2005 –2008 M.M.T. Srl pag. 3/23
INSTRUCTION MANUAL - English
Safety accessory for minimum level, series 230 + 800.
Code: 230-210-1Z Electronic self-testing conductivity level switch SIL3
800-000-5W Safety probe
Thank you for purchasing this 230/800 series level switch. Before using the device, please read this manual
carefully and keep it in a safe place for future use.
1 - Description
The electronic self-testing conductivity level switch series 230 together with the safety probe series 800 are a
limiting safety-accessory device in the IV category for industrial boilers and steam generators.
They are compliant with the following European Directives:
Low Voltage Directive 2014/35/UE
EMC Directive 2014/30/UE
PED Directive 2014/68/UE
Applied norms: EN 12953-9
IEC 61508
Given the particular mechanical construction of the probe and the use of a specific electronic circuit, the device
can safely measure water presence inside a boiler. The measurement is conductive.
Two independent alarm contacts signal:
-Lack of water, below the established level
-insulation loss inside the probe
-failure inside the device (by self-testing)
-wiring breakage between the probe and the device
Reset of the level switch is automatic; if manual reset is required, this must be obtained out by external circuitry.
In accordance with EN 12953-6 standard (TRD 604), our safety accessories comply with the regulation for the
low water level limiter.
2 - Technical characteristics of electronic self testing conductivity water level switch, series 230
-power supply, according to order code:
Z=8
→
110 ÷ 230 Vac +10% -15%
Z=9
→
24Vac +10% -15% / 24Vdc +10% -15%
- Overvoltage category: II
- Degree of pollution = 2
- frequency: 47/60 Hz
- IP code: IP10
-power absorption: 3 VA
- working environment: 0°C ÷ 55 °C
- electronically controlled by two microcontrollers
- double conductivity measurement circuit, with a compensation electrode
- output: 2 exchange-independent relay contacts, 230V - 2.5A - AC1 (resistive load), 10 million operations
when unloaded; 260000 operations when loaded
- positive safety, burner-break circuit
- conductivity: >10S/cm (special version on request)
- maximum voltage on the electrode = 0.81 V_RMS AC at 78 Hz, with no DC component
- mechanical dimension (mm):

ISO 9001
M . M . T . s.r.l. 26010 CAPRALBA (CR) - ITALY - Via degli Artigiani, 56 tel. [phone] - fax. [phone]
www.mmtitalia.com e-mail: [email protected]
Man_E_230_21y_0z_man_s2.8x_rev0_SIL3.doc
© 2005 –2008 M.M.T. Srl pag. 4/23
The level switch can be installed on the panel door of the cabinet, using the provided accessory kit, which
includes a rubber gasket, a frame and 2 fixing crews. It is provided also a plastic clip, in order to possibly use the
mounting DIN rail.
For door mounting, use the following drilling and cutout template.
Dotted lines indicates the outline of the device.
Solid lines indicates the size of the hole.
Note: in case of mounting of multiple level-switch next to each other, keep a separation between each of at least
20 mm.

ISO 9001
M . M . T . s.r.l. 26010 CAPRALBA (CR) - ITALY - Via degli Artigiani, 56 tel. [phone] - fax. [phone]
www.mmtitalia.com e-mail: [email protected]
Man_E_230_21y_0z_man_s2.8x_rev0_SIL3.doc
© 2005 –2008 M.M.T. Srl pag. 5/23
3- Technical characteristics of the 800 probe
- threaded connection:
- PS = 32 bar (on the electrode)
- TS = 239 °C (on the electrode)
- electric connection: DIN 43650 male IP65
- stainless steel body, with PTFE insulation
- mechanical dimension (mm):
W=0
→
½” gas
W=1
→
¾” gas
Electrode of reference
86
262
175
distance tube
Connector DIN 43650A
male
threaded connection 1/2" gas
or 3/4" gas
Threaded electrode 8 MA
wrench 27 or 32

ISO 9001
M . M . T . s.r.l. 26010 CAPRALBA (CR) - ITALY - Via degli Artigiani, 56 tel. [phone] - fax. [phone]
www.mmtitalia.com e-mail: [email protected]
Man_E_230_21y_0z_man_s2.8x_rev0_SIL3.doc
© 2005 –2008 M.M.T. Srl pag. 6/23
4 - General Safety information
Safe use of the product depends on correct installation. All necessary operations and interventions on this
machine must be performed by a qualified technician, according to the operating instructions.
Qualified technicians are people that have:
- knowledge of electrical engineering
- knowledge of electric safety regulations
- knowledge of accident prevention
It is important to follow general instructions, safety installation procedures and safety regulations for thermal
and electric plants, and use all the tools and safety equipment properly.
The product has been designed and produced to withstand conditions encountered during normal use.
The use of the product for any other purpose, or failing its proper installation, or not following the instructions,
can cause damage to the product, can invalidate its CE marking, and can cause serious injuries or death to people,
things and the environment.
The level probe and the level switch are only a part of the safety chain.
To complete the safety chain, additional devices are required, such as wirings, relays, bells, lamps, and actuation
devices.
The chain has to be designed and built to be fail-safe.
In case of fire in the environment, seismic events or adverse atmospheric events (wind), the correct working of
the safety accessory is no longer guaranteed.
In these cases, the power supply must be immediately shut off from the safety accessory; and the probe, the level
switch and the cable between them must be checked by a qualified technician.
Only after having verified that the accessory is not damaged, can the power supply be reconnected.
4.1 Probe
All the operations on the probe must always be done exclusively by a qualified technician.
The operations on the probe must always be done when the boiler is not pressurized and cold.
Remember that a boiler can remain at a high temperature also for a long time after depressurization.
Contact the manufacturer of the boiler for information about the water alarm level.
Consider carefully that in some cases, the water level in the boiler may be different from the external indicator.
The electrode needs to be positioned at least 14 mm from the protection tube (if present), or from the sides of the
boiler.
Do not install the probe in the open air without suitable protection against atmospheric agents.
The vent and drain holes must always be free and clear, and never covered.
4.2 Level switch
Always entrust all the operations on the level switch exclusively to a qualified technician.
Operations on the level switch must always be performed when the power supply is shut off, because dangerous
voltages may be present inside the level switch.
Before performing any operation or test on the safety accessory, the technician must be electrostatically
discharged to avoid damaging the equipment.
The power supply must be protected against the risk of short circuits or overcurrent by a suitable system
according to the construction standard of the electric cabinet and plant, to enable easy maintenance, service, and
repair.

ISO 9001
M . M . T . s.r.l. 26010 CAPRALBA (CR) - ITALY - Via degli Artigiani, 56 tel. [phone] - fax. [phone]
www.mmtitalia.com e-mail: [email protected]
Man_E_230_21y_0z_man_s2.8x_rev0_SIL3.doc
© 2005 –2008 M.M.T. Srl pag. 7/23
5 - Installation
On the probe label there is "with electronic switch □ 230 / □ 231". Please tick using a permanent marker
the appropriate level switch code used with the probe, in order to identify the set used once the system is
installed.
5.1 - Mechanical assembly of the probe
The probe series 800 must be mounted vertically in the boiler.
The length of the electrode must be cut according to the height of the low-level alarm.
In order to correctly cut the electrode, please follow the following procedure:
1. The lower end of the electrode is an internally threaded cylinder, with a small hole on one side. The probe
and the electrode must be screwed together, then fixed with the retaining pin and lock-nut.
2. Use a 6mm spanner on the probe flats, in order to prevent probe rotation.
3. Screw the lock-nut completely onto the probe, but do not tighten it in this phase.
WARNING: the threaded end of the probe must not be allowed to rotate in the body of the probe,
otherwise damage of the internal wiring could take place.
4. Screw the electrode onto the probe until the hole of the probe aligns up with the bottom end of the slot in the
electrode (see image below).
5. Holding the assembly firmly, insert the retaining pin until its protrusions from both sides of the electrode are
symmetrical.
6. Tighten the lock-nut onto the electrode ( with torque 4 ÷ 7 Nm ); these operations prevent the unscrewing and
loosening of the electrode.
7. Be sure that the water level in the boiler is at the minimum height required for safety.
8. Mark a line for the whole length of the electrode using a water soluble felt-tip pen.
9. Insert the probe with the assembled electrode in the boiler: the positioning must be made so that foams or
internal turbulences in the boiler do not alter the functionality of the probe.
10. Screw the electrode onto the probe by hand.
11. Remove the probe and mark the point at which the ink has been dissolved by water.
12. Cut the electrode to this length using a fine hacksaw.
13. Smooth the end of the electrode.

ISO 9001
M . M . T . s.r.l. 26010 CAPRALBA (CR) - ITALY - Via degli Artigiani, 56 tel. [phone] - fax. [phone]
www.mmtitalia.com e-mail: [email protected]
Man_E_230_21y_0z_man_s2.8x_rev0_SIL3.doc
© 2005 –2008 M.M.T. Srl pag. 8/23
The probe with electrode can now be assembled permanently onto the boiler.
Interpose the included copper gaskets.
The electric contact between the thread of the probe and the body of the boiler must be secure; a bad contact can
cause the malfunction of the level switch.
To work properly, the probe series 800 does not need to be assembled inside a pipe; however to reduce the
effects of the level fluctuations, of foam or of turbulence, a suitable pipe can be used.
The pipe must present some holes in its body, to allow the free circulation of water and cleaning and to prevent
deposit formation; the diameter of these holes must be larger than 20 mm and smaller than 1/3 of the internal
diameter of the pipe itself. These holes should be positioned in the lower part and in the higher part of the pipe
itself.
The minimum distance between the measure electrode and boiler sides, or between other internal parts of the
boiler and the pipe, must be greater than 14 mm.
Each pipe cannot be used for more than one probe series 800.
Follow the instructions reported in the following drawing.

ISO 9001
M . M . T . s.r.l. 26010 CAPRALBA (CR) - ITALY - Via degli Artigiani, 56 tel. [phone] - fax. [phone]
www.mmtitalia.com e-mail: [email protected]
Man_E_230_21y_0z_man_s2.8x_rev0_SIL3.doc
© 2005 –2008 M.M.T. Srl pag. 9/23
5.2 - Level switch installation
The level switch must always be inserted in a suitable industrial electric cabinet, with appropriate protection from
the environment, or in a fireproof enclosure, with an IP code IP4X or superior.
The level switch must be placed inside the electric cabinet, using the suitable DIN rail hook (see par. 2).
Should there be more than one level switch in the same electric cabinet, ensure at least 20 mm spacing between
them for air circulation.
WARNING: danger! during the operation, the terminal block of the level switch may be at a
dangerous voltage and danger of electric shock. The operations on the level switch must always be
done with the power supply turned off; see also §4.
For the electric wiring, refer to the following diagram:
5.3 - Electric power supply (terminal board 1-2)
Before powering the device, verify that the power supply voltage corresponds to the power supply indicated on
the label.
Ensure that, when supplying the level switch, the front green LED labelled "PW" is ON.
After installation, before filling the boiler, verify that the measure electrode is NOT in contact with the wall of
the boiler or with the surge pipe. To do that, use the test button SC as described below.

ISO 9001
M . M . T . s.r.l. 26010 CAPRALBA (CR) - ITALY - Via degli Artigiani, 56 tel. [phone] - fax. [phone]
www.mmtitalia.com e-mail: [email protected]
Man_E_230_21y_0z_man_s2.8x_rev0_SIL3.doc
© 2005 –2008 M.M.T. Srl pag. 10/23
5.4 - Push buttons usage
In the bottom part of the front panel, there are 4 push buttons available. Their function is as follows.
- LA (Last Alarm): when kept pressed, the display shows the latest alarm code since the last time the level switch
was powered. At power on, this code is “0” by default.
- P (probe): when kept pressed, the connection between the probe and the level switch is interrupted.
After a few seconds its displayed alarm “2”.
- C (cable): when kept pressed, a second connection between the probe and the level switch is interrupted.
After a few seconds its displayed alarm “F”.
- SC (short circuit): when kept pressed, the level switch performs a test to evaluate a possible presence of a short
circuit between the probe and GND. Caution: the test lasts about 20”: keep the button pressed meanwhile.
At the end of the 20” on the display is shown one of these two possible codes:
- digit ‘0’, with a fix dot point: NO short circuit was detected
- digit ‘E’, with a fix dot point: Caution: a possible short circuit between the probe and GND was detected.
Consequently relays have been de-energized.
When the SC button is released, in a few seconds the display behavior returns to normal.
Caution: if alarm ‘E’has been detected, when the test ends, relays are re-energized as in a NO-alarm situation.
Caution: if the SC test is performed after the start-up of the boiler, it is possible to have the ‘E’alarm if the
conductivity of the water is very high, greater than 6000s/cm.
5.5 - Wiring between probe and level switch (terminal board 10-11-12-13-14)
For the wiring between the probe and the level switch, use a 4 x 0.25 mm2 or 4 x 0.50 mm2 screened cable; the
cable has to be suitable for the temperature of the environment in which it is used, particularly when near the
boiler. The maximum length of the cable is 30 m.
As shown in the drawing above, wire the cable end with a DIN female connector, supplied with the probe, to
ensure the wiring is securely connected with the head of the probe.
The cable screen works as a functional ground, not as a protective earth.
Connect the cable screen as in the scheme above (see §5.2).
Do not connect to earth pins #13 and #14 of the level switch, otherwise this could create undesired earth loops,
which may reduce the performance of the level switch, and potentially damage it.
5.6 - User’s wiring (terminal board 4-5-6 and 7-8-9)
The level switch has 2 independent output contacts in exchange, which can be used to control the boiler burner
and to signal alarm.
The contacts are closed when there is NO alarm; or open when there is alarm (positive safety).
A recommended diagram is show in the §6.2.
Should there be inductive loads, contact commutation may produce voltage spikes that may influence the
operation of the measurement and control systems.

ISO 9001
M . M . T . s.r.l. 26010 CAPRALBA (CR) - ITALY - Via degli Artigiani, 56 tel. [phone] - fax. [phone]
www.mmtitalia.com e-mail: [email protected]
Man_E_230_21y_0z_man_s2.8x_rev0_SIL3.doc
© 2005 –2008 M.M.T. Srl pag. 11/23
The user will have to use appropriate protection against discharge, depending on the load connected to the
contacts themselves, in accordance with EN 12953-9, item 4.4.3.4.
6 - Operation
The level switch continuously measures two different electric resistances: the first between the “measure”
electrode and the ground of the boiler; the second between the “reference”electrode and the ground of the boiler.
Analysing the values of these two resistances, the device is able to determine if there is water in contact with the
“measure” electrode or if the probe has a loss of insulation.
The device also performs periodically internal diagnostic tests to verify its functionality in ohmic measurements
on the “measure”electrode and on the “reference”electrode; and to verify the wiring integrity.
Analysis of all measurements leads to the determination of the status of the system: if the level switch recognizes
one of the possible alarm conditions, it automatically goes into alarm mode.
Since the system is a positive safety device, in normal working conditions the 2 internal relays are ON, both the
front red LED labelled "Safe" are ON and the 8-segment displays show '0'.
In alarm condition, the relays open, both the front red led go OFF, the display shows a different code that
corresponds to the particular situation of alarm; the two change-over contacts interrupt the safety chain.
In case of no water (alarm code ‘1’), the level switch de-energizes relays opening their contacts in about 8”.
List of alarm codes with the corresponding situation for version 230:
Code
Situation
0
no alarm (normal situation); water presence
1
no water
2
interrupted wire or no communication with probe
3
anomalous operation
4
too high resistance of the connection cable
6
interrupted wire or no communication with probe
7-9
anomalous operation
8
water presence on the “reference”electrode
C
test of the internal 100 ohms resistor outside the proper range
E
short circuit between “measure”electrode and ground / too high conductivity of water
F
interrupted wire or no communication with probe
H
anomalous operation signaled by the diagnostic microcontroller

ISO 9001
M . M . T . s.r.l. 26010 CAPRALBA (CR) - ITALY - Via degli Artigiani, 56 tel. [phone] - fax. [phone]
www.mmtitalia.com e-mail: [email protected]
Man_E_230_21y_0z_man_s2.8x_rev0_SIL3.doc
© 2005 –2008 M.M.T. Srl pag. 12/23
6.1 - Troubleshooting
Alarm code 1
Verify that the level of the water is indeed below the minimum required.
If the level is above, and the alarm continues, verify that the conductivity of the
water in the boiler is in the conductivity range of the used level switch (see
label).
If it is out of range, it is necessary to replace the level switch with a suitable one
(appropriate for conductivity of the water).
If conductivity is in the range, verify the connection between the level switch
and the probe, the integrity of the probe, and of the electrode.
Alarm codes 2, 6, F
Verify the connection between the level switch and the probe; if it has been
performed according to scheme (see §5.2), and the situation of alarm remains, it
means that there is a broken connection.
Alarm codes 3, 7, 9,
C, H
Possible failure inside the level switch, related to self testing. The alarm must
switch off within 10 seconds. If the alarm remains, the level switch must be
replaced.
Alarm code 4
Verify the connection between probe and level switch. The wire is too long or
its resistance is too high.
Alarm code 8
Verify that the conductivity of the water in the boiler is in the range of
conductivity of the level switch used (see its label); if it is out of range, it is
necessary to replace the level switch with a suitable one (appropriate for
conductivity of the water).
If conductivity is in the range, remove the probe from the boiler (see §4), and
verify that there are no deposits or dirt on the probe.
If there are no deposit or dirt on the probe, an infiltration could have taken place
inside the probe; in this case the probe must be replaced.
Alarm code E
The resistance between measure electrode and ground is too low. There is
probably a short circuit between the measure electrode and ground, or the
conductivity of water is too high. Please, see §5.4.
If, after the above troubleshooting, the alarm condition remains, or different situations arise, it will be necessary
to replace the whole safety accessory (level switch + probe), and contact our technical service.
It is possible to manually verify some important functionalities of the level switch.
Refer to §5.4.
These tests must only be performed by qualified technical staff (see §4).
Warning: consider carefully that during these manual tests, an alarm is intentionally produced and the
boiler will stop. Take all the necessary safety precautions to ensure there are no risks for the boiler,
for the people, or for the environment.
Before performing any operation or test on the safety accessory, is mandatory to electrostatic
discharge ourselves, in order not to damage the accessory.
If there is a lockout circuit with manual reset, the operator will have to restart the boiler.
If at least one of the 2 manual tests is not carried out successfully, as described above, it means that the level
switch does not work correctly and must therefore be replaced or repaired, according to the operational and
installation procedures.

ISO 9001
M . M . T . s.r.l. 26010 CAPRALBA (CR) - ITALY - Via degli Artigiani, 56 tel. [phone] - fax. [phone]
www.mmtitalia.com e-mail: [email protected]
Man_E_230_21y_0z_man_s2.8x_rev0_SIL3.doc
© 2005 –2008 M.M.T. Srl pag. 13/23
6.2 - Example of connection:
A typical example of work for the series 230 is the following:
7 - Maintenance
The level switch does not require particular maintenance or service.
The probe must be cleaned and inspected at least once a year.
For aggressive water, periodically verify the “measure”electrode; clean it with an abrasive paper (always
operate when the boiler is not pressurized and cold, see §4).
Occasionally test the functionality of the equipment, proceeding as described in §5.3,by manually simulating a
possible alarm condition and verifying the correct response of the equipment, in accordance with EN 12953-9,
item 5.6.3.
After maintenance, reassemble everything following instructions in §4 of this instruction manual.
8 - Disposal
Only entrust this operation to qualified staff.
The unusable equipment parts must be disposed of using proper means, to guarantee safety.
9 - Accessories
Included:
-connector DIN 43650A female cod. 999-027-00, as end part of the wire between the probe and the level switch
-copper gasket
- frame, rubber gasket, fixing screws for mounting on the door
Optional:
- electrode: 10 mm diameter, 500 mm in length (cod. 999-800-05)
- electrode: 10 mm diameter, 1000 mm in length (cod. 999-800-10)

ISO 9001
M . M . T . s.r.l. 26010 CAPRALBA (CR) - ITALY - Via degli Artigiani, 56 tel. [phone] - fax. [phone]
www.mmtitalia.com e-mail: [email protected]
Man_E_230_21y_0z_man_s2.8x_rev0_SIL3.doc
© 2005 –2008 M.M.T. Srl pag. 14/23
SAFETY MANUAL –SIL
Safety Level Controller 230/231 + probe 800 up to SIL 3 in single (1oo1) module/probe
configuration

ISO 9001
M . M . T . s.r.l. 26010 CAPRALBA (CR) - ITALY - Via degli Artigiani, 56 tel. [phone] - fax. [phone]
www.mmtitalia.com e-mail: [email protected]
Man_E_230_21y_0z_man_s2.8x_rev0_SIL3.doc
© 2005 –2008 M.M.T. Srl pag. 15/23
Summary
SAFETY MANUAL –SIL......................................................................................................................................13
Safety Level Controller 230/231 + probe 800 up to SIL 3 in single (1oo1) module/probe configuration....14
1. Manufacturer Information...................................................................................................................16
2. Equipment identification and ordering code .......................................................................................16
3. Introduction..............................................................................................................................................16
3.1 Scope ......................................................................................................................................................16
3.2 Intended Use ........................................................................................................................................17
3.3 Relevant Standards and Directives...................................................................................................18
3.3.1. Device specific standards and directives..................................................................................18
3.3.2. System specific standards and directives.................................................................................18
4 Planning.....................................................................................................................................................18
4.1 System constraint and SIL loop determination ..................................................................................18
4.1.1 Low Demand Mode .........................................................................................................................18
4.1.2 SIL assessment of the safety loop ...................................................................................................18
4.1.3 Special consideration on (SFF) Safe Failure Fraction.......................................................................19
5 Assumptions..............................................................................................................................................19
5.1 Configuration......................................................................................................................................19
6 Safety Function and Safe State..................................................................................................................21
7 Reaction Time............................................................................................................................................21
8 Characteristic Safety Values......................................................................................................................21
9 Life Time....................................................................................................................................................21
10 Installation and Commissioning ..............................................................................................................22
11 Proof Test ....................................................................................................................................................22
11.1 Proof Test Procedure............................................................................................................................22
12 Abbreviations ..............................................................................................................................................23

ISO 9001
M . M . T . s.r.l. 26010 CAPRALBA (CR) - ITALY - Via degli Artigiani, 56 tel. [phone] - fax. [phone]
www.mmtitalia.com e-mail: [email protected]
Man_E_230_21y_0z_man_s2.8x_rev0_SIL3.doc
© 2005 –2008 M.M.T. Srl pag. 16/23
1. Manufacturer Information
M . M . T . s.r.l.
26010 CAPRALBA (CR) - ITALY
Via degli Artigiani, 56
tel. [phone]
fax. [phone]
www.mmtitalia.com
e-mail: [email protected]om
2. Equipment identification and ordering code
Ordering codes:
•230-210-1K low level safety controller with diagnostic
Code
Characteristics
Power supply
230-210-19
Conductivity>10 μS/cm
24Vac/dc
230-210-18
Conductivity>10 μS/cm
230Vac
•231-210-1K high level safety controller with diagnostic
Code
Characteritics
Power supply
231-210-19
Conductivity>100 μS/cm
24Vac/dc
231-210-18
Conductivity>10 μS/cm
230Vac
•800-000-5W Level probe
Code
Temperature
Pressure
Thread
800-000-50
239°C
32 bar
½ inch
800-000-51
239°C
32 bar
¾ inch
3. Introduction
3.1 Scope
This manual is the “SIL Safety manual” of the device in the scope of the document.
This manual contains information for application of the device in functional safety related loops.
This manual must be read in full and definitely understood before installation of the equipment.
A copy of his manual must be stored and preserved and used in conjunction with the equipment for all useful life of the
equipment itself.

ISO 9001
M . M . T . s.r.l. 26010 CAPRALBA (CR) - ITALY - Via degli Artigiani, 56 tel. [phone] - fax. [phone]
www.mmtitalia.com e-mail: [email protected]
Man_E_230_21y_0z_man_s2.8x_rev0_SIL3.doc
© 2005 –2008 M.M.T. Srl pag. 17/23
The corresponding relevant documents including data sheets, installation, operating and maintenance instructions, CE
Declaration of Conformity and all applicable Certificates/Reports must be used in conjunction with this document.
The documents aforementioned are available from MMT Srl.
Only trained and qualified personnel and operators shall be involved in mounting, commissioning, operating, maintenance
and dismounting of any devices may be included in the safety loop.
Installation related faults fixing is admitted acting on external features of the equipment; if fixing is not successful, the
devices must be taken out of service and action taken to protect against accidental use.
Faulty devices shall be delivered to and only be repaired directly by the original manufacturer.
De-activating or bypassing safety functions causing impairment of safety functions may cause injuries to property,
environment or persons for which MMT Srl will not be liable.
Failure in application of advice given in this manual causing impairment of safety functions may cause injuries to property,
environment or persons for which MMT Srl will not be liable.
3.2 Intended Use
The equipment must only be used for the applications described in the instructions and with specified environmental
conditions, and only in conjunction with approved external devices.
The device monitors levels of conductive fluids: low level (type 230), or high level (type 231) leads to trip of the output (de-
energized output relays).
The device provides alarm and shutdown functions associated with level control of fluids.
The device is equipped with a three level self-diagnostic.
The first level diagnostic detects a probe loss of insulation.
The second level diagnostic detects the probe/regulator wire breakage.
The third level diagnostic detects a generic fault in the circuitry affecting the safety function.
The output counts two independent relays.
During an error condition the outputs de-energize (fail-safe).
During a loss of power the outputs de-energize (fail–safe).
If not otherwise arranged, the chain involved in the safety integrated system must be fail-safe.
The single module including one Safety Level Controller type 230 or 231 + one probe type 800 is suitable for use in safety
related control loop of systematic capability and level of integrity up to SIL3.

ISO 9001
M . M . T . s.r.l. 26010 CAPRALBA (CR) - ITALY - Via degli Artigiani, 56 tel. [phone] - fax. [phone]
www.mmtitalia.com e-mail: [email protected]
Man_E_230_21y_0z_man_s2.8x_rev0_SIL3.doc
© 2005 –2008 M.M.T. Srl pag. 18/23
3.3 Relevant Standards and Directives
3.3.1. Device specific standards and directives
The devices are developed, manufactured and tested according to the relevant safety standards and applicable Directives.
Standards
Pressure equipment: EN 12953-9 edition 2007 : Standard for Shell boilers - Part 9: Requirements for limiting devices of
the boiler and accessories.
Electromagnetic compatibility: EN 61326-2-3 edition 2006: Standard for electrical equipment for measurement, control
and laboratory use - EMC requirements -- Part 2-3: Particular requirements - Test configuration, operational conditions and
performance criteria for transducers with integrated or remote signal conditioning.
Functional safety IEC 61508 part 1,2,3,4,5,6,7 edition 2010:Standard for functional safety of
electrical/electronic/programmable electronic safety-related systems (product manufacturer).
Directives
-Low voltage Directive 2014/35/EU.
-Electro Magnetic Compatibility 2014/30/EU.
-Pressure equipment Directive 2014/68/EU.
3.3.2. System specific standards and directives
Functional safety IEC 61511 part 1,2,3, edition 2003:
Standard of functional safety: safety instrumented systems for the process industry sector (user).
4 Planning
4.1 System constraint and SIL loop determination
4.1.1 Low Demand Mode
The demand rate for the safety loop including the Safety Level Controller 230/231 + probe 800 is assumed to be performed
on demand only, in order to transfer the EUC (steam boiler, hot water boiler) into a specified safe state, and the frequency
of demands is assumed to be no greater than one per year (low demand mode).
4.1.2 SIL assessment of the safety loop
The relevant safety parameters to be verified in order to are:
•the PFDavg value (average Probability of Failure on Demand) and
•Tproof (proof test interval that has a direct impact on the PFDavg) and
•the SFF value (Safe Failure Fraction) and
•the HFT architecture (Hardware Fault Tolerance architecture)

ISO 9001
M . M . T . s.r.l. 26010 CAPRALBA (CR) - ITALY - Via degli Artigiani, 56 tel. [phone] - fax. [phone]
www.mmtitalia.com e-mail: [email protected]
Man_E_230_21y_0z_man_s2.8x_rev0_SIL3.doc
© 2005 –2008 M.M.T. Srl pag. 19/23
4.1.3 Special consideration on (SFF) Safe Failure Fraction
The safe failure fraction is the measure of residual ratio of unsafe failures against the total failure rate amount.
SFF = (λs +λdd) / λtot = 1- λdu / λtot
The safe failure fraction is only relevant if determined for elements or (sub)systems in a complete safety loop.
The device under consideration is intended to be a part of a safety loop and, according to the chosen safety chain can be or
cannot be a complete element or subsystem, depending on the (sub)system it is included in.
Contact MMT experts in case of any doubts on SFF calculation constraints.
5 Assumptions
5.1 Configuration
The following assumptions have been made during the FMEDA analysis:
•The input is generated by the probe 800
•The output safety function includes the series of the contacts of the two internal relays according to the following
example:
•The safe status of the EUC (steam boiler, hot water boiler) must be chosen considering that the safe state for the
Safety Level Controller 230/231 + probe 800 is “de-energized relay”; decide for expected safe status of relay
contacts accordingly.
•All three diagnostic levels are activated.
•The device can claim less than 15% of the total failure budget for a SIL3 safety loop.

ISO 9001
M . M . T . s.r.l. 26010 CAPRALBA (CR) - ITALY - Via degli Artigiani, 56 tel. [phone] - fax. [phone]
www.mmtitalia.com e-mail: [email protected]
Man_E_230_21y_0z_man_s2.8x_rev0_SIL3.doc
© 2005 –2008 M.M.T. Srl pag. 20/23
•For a SIL3 application operating in Low Demand Mode the total PFDavg value of the SIF (Safety Instrumented
Function) should be smaller than 10-3, hence the maximum allowed PFDavg value is 1,5x10-4.
•Failure rate of components is based on the Siemens SN29500 data base.
•Failure rates are constant, wear out mechanisms are not included.
•External power supply failure rates are not included; the Safety Level Controller 230/231 + probe 800 is nevertheless
a “fail safe” device leading to a safe status the relay output when a loss of power is handled.
•The safety-related device couple is considered to be of type B components with a Hardware Fault Tolerance of 0.
•It is assumed that the appearance of an error (relay output in safe state) would be repaired within 7 hours (e. g.
remove device burnout).
•It is assumed that the indication of an error (relay output in safe state) would be detected within 1 hour by the logic
solver.
•The stress levels are average for an industrial environment and can be compared to the Ground Fixed Classification
of MIL-HNBK-217F.
•The required installation environment must be comparable to IEC 60654-1 Class C (sheltered location) with
temperature limits within the manufacturer's rating and an average temperature over a long period of time of 40
ºC. For a higher average temperature up to 55 ºC, the failure rates should be multiplied with an experience based
factor of 2.5. A similar multiplier should be used if frequent temperature fluctuation must be assumed. Contact
MMT in case of installation in harsh environment.
•During removal of the device for maintenance or repairing, the safety function must be guaranteed by the
substitution with an identical device.