MSA Ultima X Series User guide

Ultima®X Series
Gas Monitor
Safety Manual
SIL 2 Certified
"
The Ultima X Series Gas Monitor is qualified as an SIL
2 device under IEC 61508 and must be installed, used,
and maintained in accordance with this manual if
compliance with this IEC functional safety standard
is desired. Failure to do so can result in a reduced
safety level.
In the U.S., to contact your nearest stocking location, dial toll-free 1-800-MSA-INST
To contact MSA International, dial [phone].
© MSA 2015 - All Rights Reserved
This manual is available on the internet at www.msasafety.com.
Inquiries can also be e-mailed to [e-mail].
Manufactured by
MSA NORTH AMERICA
1000 Cranberry Woods Drive, Cranberry Township, PA 16066
(L)- Rev 1 Y-HLR 10100751

Table of Contents
Chapter 1,
Purpose and Scope . . . . . . . . . . . . . . . . . . . . . . .1-1
Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-1
Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-1
Chapter 2,
Using the Ultima X Series Gas Monitors . . . . . .2-1
Safety Function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-1
Safety Integrity Level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-1
Safety Accuracy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-1
Diagnostic Response Time . . . . . . . . . . . . . . . . . . . . . . . . . . .2-2
Gas Detection Times . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-2
Update Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-2
Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-2
Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-2
Configuration and Calibration . . . . . . . . . . . . . . . . . . . . . .2-2
Proof Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-3
Routine Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-5
Periodic Calibration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-5
Periodic Sensor Replacement for Oxygen,
Toxic, and Catalytic Combustible sensors . . . . . . . . . . . .2-6
Cleaning Monitor Windows on the XIR Sensor . . . . . . . .2-6
Repair and Replacement . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-7
Fault Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-7
Modification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-8
Reliability Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-8
Lifetime Limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-8
Environmental Limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-8
Application Limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-8
Required Output Load . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-8
Required Compliance Voltage . . . . . . . . . . . . . . . . . . . . .2-9
Use of Wireless IR interface . . . . . . . . . . . . . . . . . . . . . . .2-9
Use of LCD Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-9
Limitations Associated with Oxygen Monitoring . . . . . . . .2-9
Limitations Associated with Toxic Gas
and Combustible Gas Monitoring . . . . . . . . . . . . . . . . . .2-9
i

Chapter 3,
Terms and Definitions . . . . . . . . . . . . . . . . . . . . .3-1
List of Tables
Table 2-1. Proof Test for Ultima X Series Gas Detectors . . . .2-4
Table 2-2. Expected Alarm Relay States Gas Type . . . . . . . .2-5
ii

1-1
Chapter 1,
Purpose and Scope
Purpose
In order to maintain the designed safety level (SIL 2) for installation and
operation of the MSA Ultima X Series Gas Monitors, this safety manual
provides the specific requirements of user responsibilities in the
following areas:
• proof testing
• transmitter repair and replacement
• reliability data
• product life
• environmental and application limits
• parameter settings.
Scope
This manual applies to the following analog output (4-20 mA) models:
• general-purpose Ultima XA monitor
• explosion-proof Ultima XE monitor
• explosion-proof Ultima XIR monitor.

Chapter 2,
Using the Ultima X Series Gas Monitors
Safety Function
The safety function of the Ultima X Gas Monitor is to:
• monitor gas concentration
• update outputs based on this monitoring.
• The outputs consist of:
• an analog output that reflects the gas concentration
• three alarm relay outputs
• one fault relay output.
• The analog output is a scaled 4-20 mA output value where:
• 4 mA represents 0% of range and
• 20 mA represents 100% of range.
• The alarm relay outputs allow for three independent,
configurable alarms which energize or de-energize
the coil when gas concentration exceeds the configurable
threshold values.
Safety Integrity Level
The Ultima X Gas Monitor is certified to meet the requirements of
Safety Integrity Level (SIL) 2 according to IEC 61508: 2010 for use in
low demand applications only.
• Oxygen, catalytic combustible and IR gases are SIL 2 w/ HFT = 0
(Hardware Fault Tolerance).
• Toxic gases are SIL 2 w/ HFT = 1 and SIL 1 w/ HFT = 0.
Safety Accuracy
The Ultima X Gas Monitor has a safety accuracy of 10%. This means
that internal component failures are listed in the device failure rate
if these failures cause an error of 10% or greater.
2-1

Diagnostic Response Time
The Ultima X Gas Monitor has a diagnostic response time of 24 hours.
This means that any detectable hardware failure is detected and
reported within 24 hours of fault occurrence. This time is equal to the
sum of the diagnostic test interval and the fault response time.
Gas Detection Times
The amount of time it takes to detect the presence of a gas varies
based on sensor type.
• Refer to this information in TABLE 3-1 of the Ultima X Series
Gas Monitor Instruction Manual (P/N 10036101).
Update Time
The state of the analog output and the relay outputs is updated every
second or sooner.
Setup
Installation
For installation, refer to instructions given in chapter 1 of the
Ultima X Series Gas Monitor Instruction Manual (P/N 10036101).
Configuration and Calibration
After installing the Ultima X Gas Monitor, a calibration must be done to
ensure proper operation. Perform the INITIAL Calibration procedure
given in chapter 2 of the Ultima X Series Gas Monitor Instruction
Manual (P/N 10036101).
No gas monitor configuration is required for the analog output.
However, configuration may be required to use the alarm outputs.
• Alarm relays are factory-enabled as non-latching, de-energized.
• Alarm relays activate when the monitor detects a gas concentration
level that exceeds setpoints.
• Factory configuration of alarms 1, 2, and 3 is generally
to set the alarms when 10%, 20%, and 30% of full scale reading
is exceeded, respectively.
2-2

NOTE: these settings are sensor-specific and may vary depending
on the sensor installed.
• The following sensor settings may be changed:
• setpoints
• direction of the alarm
• latching or nonlatching
• enabled or not enabled.
• If necessary, these items can be configured using the HART or
the Ultima X Controller. For details on how to make these
changes, refer to the Ultima/Ultima X Controller and Calibrator
manual (P/N 813379).
• When using HART, ensure safety function is not affected by
utilizing password protection or other security measures to
prevent unvalidated changes to instrument parameters.
• If alarm outputs will be used for safety-related functions, they
must be tested prior to system operation. Once alarm outputs
are configured, apply and remove gas to and from the system
to ensure that alarms:
• are set when the thresholds are exceeded
• latch if configured to do so, or clear if they are not.
Proof Testing
The recommended proof test for the Ultima X Gas Monitor is given in
TABLE 2-1. This is a periodic test recommended to help detect the
majority of any dangerous, undetected failures. The proof test coverage
for this test depends on sensor type. The details may be found in the
FMEDA report, which is available upon request.
Perform this test periodically at intervals known as the proof test
interval, which must be chosen to meet the probability of failure on
demand requirements for SIL 2.
2-3

Table 2-1. Proof Test for Ultima X Series Gas Detectors
TEST EXPECTED OUTCOME
1.
Bypass the safety function or take None
appropriate action to avoid a false trip.
Note that calibration output signal must
be disabled so the analog output can
be measured during the test.
2.
Perform a zero and span calibration as Analog output should read 4mA when zero
defined in the regular calibration section gas is connected. Analog output should be
of the Ultima X Series Gas Monitor scaled between 4 mA and 20 mA when span
instruction manual. While performing gas is applied. Exact analog output value
calibration, measure the analog output depends on span gas concentration. (e.g., if
when the device has zero gas or span span gas concentration is 50% LEL,
gas connected. If alarm relays are used, analog output should be 12 mA
check relay output
Reaction of external relays varies, based on
configuration. See TABLE 2-2 for detailed
relay reaction based on configuration. Any
activated relays should remain activated when
gas is removed if they are configured to latch;
otherwise,. relays deactivate when gas
is removed
If calibration is successful, the display shows
“END” after the zero and the span
calibration steps
3.
If using alarm relays, and any alarm Relay should activate when span gas is
relay did not activate in the step 2 applied. When span gas is removed, alarm
because the alarm setpoint was higher should remain active if it is configured
than the span gas concentration, the to latch; otherwise, it should become inactive
relay should be activated in this test.
Change the setpoint for any such alarms
to a value just below the span gas
concentration. Now apply the span gas
as it was done during calibration
4.
Remove the span gas When span gas is removed, the alarm should
remain active if it is configured to latch;
otherwise, it should become inactive
5.
Change the setpoint back to the None
desired value
6.
Remove the bypass or otherwise None
reverse the action taken in step 1
2-4

Table 2-2. Expected Alarm Relay States Gas Type
SETPOINT ALARM ALARM RELAY ALARM RELAY
SETTING STATE WITH STATE WITH
ZERO GAS SPAN GAS
APPLIED APPLIED
Lower than Above Set-point Not active Activated
span gas
concentration
Lower than Below Set-point Activated Not Active (NOTE:
span gas If alarm relays are
concentration configured as latching,
the alarm must
be cleared after the zero
gas is removed for this
state to be correct)
Higher than Above Set-point Not Active Not Active
span gas
concentration
Higher than Below Set-point Activated Activated
span gas
concentration
NOTE: Personnel performing the Ultima X proof test should be trained
in SIS operations, including bypass procedures, Ultima X
Monitor maintenance and company management of change
procedures.
Routine Maintenance
Besides proof testing, the following three maintenance procedures that
must be performed on the Ultima X gas monitors.
Periodic Calibration
To ensure accuracy and detect any sensor problems, calibrate the:
• XE and XA monitors a minimum of every three months
• XIR monitor according to the requirements as documented in the
Ultima X Series Gas Monitor instruction manual (P/N 10036101).
Calibrate monitors with catalytic combustible sensors when they have
been exposed to non-combustible chemicals known to reduce sensor
sensitivity (Silanes, Silicates, Silicones and Halides). Use the regular
calibration method given in the Ultima X Series Gas Monitor instruction
manual (P/N 10036101).
2-5

After calibration, read all messages on the LCD display and correct any
errors. Change the sensor immediately if the following messages occur:
• "SENSOR WARNING"
• "REPLACE SENSOR".
Refer to the "Limitations Associated with Toxic Gas and Combustible
Gas Monitoring" section later in this chapter.
Periodic Sensor Replacement for
Oxygen, Toxic, and Catalytic Combustible sensors
These sensors have a limited lifetime and must be replaced periodically
to ensure proper operation. Unless historical calibration records show
that sensors consistently last longer:
• replace oxygen and toxic sensors once per year
• replace catalytic combustible sensors every 18 months.
Due to environmental conditions, these sensors may require
replacement more or less frequently. If supported by calibration records:
• toxic sensors can be replaced as infrequently as every two years
• combustible sensors can be replaced as infrequently as every
three years.
• Do not exceed this replacement schedule.
Immediately replace sensors if the "SENSOR WARNING" or "REPLACE
SENSOR" messages occur after calibration.
Cleaning Monitor Windows on the XIR Sensor
NOTE: This does not apply to sensors other than the XIR sensor.
If the monitor windows on this sensor are dirty, the sensor may produce
erroneous readings. Whereas diagnostics detect this condition, the user
should also perform a periodic visual inspection of the windows. The
window is easily inspected after removing the environmental guard.
Frequency of required inspection is environmentally dependent.
In typical environments, windows never require cleaning due to the:
• environmental guard protection
• heating elements that prevent water condensation.
2-6

However, regular cleaning may be needed under severe conditions.
Adjust the inspection rate to match your particular environment.
Initially, perform inspections every six months at a minimum.
Increase the inspection frequency if:
• the unit requires cleaning at every inspection
• diagnostics report that cleaning is required more frequently than
the inspection rate.
Conversely, if the inspections rarely show that cleaning is required, the
inspection rate may be decreased. A good practice is to perform
inspections at twice the rate that cleaning is historically required. If the
windows appear dirty during the inspection, perform the XIR cleaning
procedure given in Chapter 4 of the Ultima X Series Gas Monitor
instruction manual (P/N 10036101).
NOTE: Personnel performing Ultima X proof test should be trained in
SIS operations, including bypass procedures, Ultima X Monitor
maintenance and company management of change procedures.
Repair and Replacement
Fault Conditions
The Ultima X has numerous self diagnostics that are run periodically to
detect problems in the device. When problems are found:
• messages appear on the LCD display
• depending on the severity of the problem, the analog output may
be set to 3.0 mA and the fault relay de-energized.
• The analog output or fault relay must be connected to
equipment that alerts the user that a problem exists or takes
action to move the system into a safe state.
When a fault is indicated:
• observe the LCD display for fault details.
• fix faults within the system repair time (the repair time used in
probability of failure calculations according to IEC 61508)
• Actions to correct a fault are given in TABLE 4-3 of the Ultima
X Series Gas Monitor instruction manual (P/N 10036101).
NOTE: Personnel performing Ultima X repair or replacement should be
trained in SIS operations, including bypass procedures, Ultima
X Monitor maintenance and company management of change
procedures.
2-7

NOTE: Any field failure of the Ultima X Series Gas Monitor should be
reported to MSA.
Modification
Any modifications [allowed per the Ultima X Monitor Manual
(P/N 10036101)] made to the Ultima X Monitor configuration after the
system is commissioned must be validated to ensure they were made
properly. Executing the Proof Test procedure given earlier in this
chapter may be used for this validation.
Reliability Data
A detailed Failure Mode, Effects, and Diagnostics Analysis (FMEDA)
report with all failure rates and failure modes is available from MSA.
The Ultima X Gas Monitor is certified for low demand mode applications
up to SIL2 for use in a simplex (1oo1) configuration, depending on the
PFDavg or PFH calculation of the entire Safety Instrumented Function.
Lifetime Limits
Expected Ultima X lifetime is approximately 10 years.
• Reliability data listed in the FMEDA report is only valid for this
period.
• Ultima X failure rates may increase after this period.
• Reliability calculations based on the data listed in the FMEDA
report for Ultima X lifetime beyond 10 years may yield results that
are too optimistic (i.e., calculated Safety Integrity Level will not be
achieved).
Environmental Limits
Ultima X environmental limits are given in TABLE 3-1 of the Ultima X
Series Gas Monitor instruction manual (P/N 10036101). If these limits
are exceeded, reliability data listed in the FMEDA report are not valid.
2-8

Application Limits
Required Output Load
Current output in the 3-wire operation mode is designed for loads
between 0 to 500 ohms when operated from power supply voltage
greater than 24 V.
Required Compliance Voltage
To ensure proper operation, the transmitter in 2-wire current output
operation mode must have access to a minimum of 8 V at the maximum
current output level. Available voltage is calculated by subtracting the
impact of all sources of voltage drop (such as intrinsic safety barriers
and total loop resistance) from the loop voltage.
Use of Wireless IR interface
The wireless IR interface allows the Ultima Controller and Ultima
Calibrator to communicate with the monitor. This interface should only
be used for configuration, maintenance and proof test activities.
Use of LCD Interface
The LCD interface:
• should only be used for:
• configuration
• maintenance and
• proof test activities
• should not be relied upon as the primary method to monitor the
gas concentration.
The analog output or alarm relays must be hard wired to a device that
alerts the user to an alarm condition and/or takes action to mitigate the
condition and move the system into a safe state.
Limitations Associated with Oxygen Monitoring
Limit the use of the oxygen monitoring capability to situations where
detection of oxygen-deficient situations is required.
Limitations Associated with Toxic Gas and
Combustible Gas Monitoring
Limit use of combustible gas monitoring using catalytic measurement or
2-9

IR technology and toxic gas monitoring to environments where the
monitored gas is not expected to be normally present.
• Continuous presence of such gas may shorten sensor life and
impedes the negative drift diagnostic.
• If monitored gas is found to be in the environment for an extended
period of time, recalibrate the sensor to ensure proper operation.
2-10

Chapter 3,
Terms and Definitions
FMEDA
Failure Mode Effect and Diagnostic Analysis
SIF
Safety Instrumented Function
SIL
Safety Integrity Level
SIS (Safety Instrumented System)
Implementation of one or more Safety Instrument Functions composed
of any combination of sensor(s), logic solver(s), and final element(s)
SLC
Safety Life Cycle
Safety
Freedom from unacceptable risk of harm
Functional Safety
Systems’s ability to perform actions necessary to achieve or maintain a
defined safe state for the equipment / machinery / plant / apparatus
under control of the system
Basic Safety
Equipment must be designed and manufactured so it protects against
risk of damage to persons by electrical shock and against resulting fire
and explosion. The protection must be effective under all normal
operating conditions and under single fault condition
Verification
Demonstration for each phase of the life-cycle that the (output)
deliverables of the phase meet the objectives and requirements
specified by the inputs to the phase. The verification is usually executed
by analysis and/or testing
Validation
Test that demonstrates safety-related system(s) or combination of
safety-related system(s) and external risk reduction facilities meet the
Safety Requirements Specification
3-1

Safety Assessment
Investigation determining the safety achieved by safety-related systems
Further definitions of terms used for safety techniques and measures
3-2