Pepperl+Fuchs HiD2025 User manual

ISO9001
2
SMART Transmitter
Power Supply
HiD2025(SK), HiD2026(SK),
HiD2029(SK), HiD2030(SK)
PROCESS AUTOMATION
SAFETY MANUAL SIL

With regard to the supply of products, the current issue of the following document is applicable: The
General Terms of Delivery for Products and Services of the Electrical Industry, published by the
Central Association of the Electrical Industry (Zentralverband Elektrotechnik und Elektroindustrie
(ZVEI) e.V.) in its most recent version as well as the supplementary clause: "Expanded reservation
of proprietorship"
Safety Manual SIL HiD202*(SK), HiD2030(SK)

Safety Manual SIL HiD202*(SK), HiD2030(SK)
Contents
2014-05
3
1 Introduction ........................................................................ 4
1.1 General Information ......................................................................................4
1.2 Intended Use ................................................................................................4
1.3 Manufacturer Information..............................................................................5
1.4 Relevant Standards and Directives...............................................................5
2 Planning .............................................................................. 6
2.1 System Structure ..........................................................................................6
2.2 Assumptions .................................................................................................7
2.3 Safety Function and Safe State.....................................................................8
2.4 Characteristic Safety Values.........................................................................9
3 Safety Recommendation ................................................. 12
3.1 Interfaces....................................................................................................12
3.2 Configuration ..............................................................................................12
3.3 Useful Life Time ..........................................................................................12
3.4 Installation and Commissioning ..................................................................13
4 Proof Test.......................................................................... 14
4.1 Proof Test Procedure..................................................................................14
5 Abbreviations ................................................................... 17
Safety Manual SIL HiD202*(SK), HiD2030(SK)

2014-05
4
Safety Manual SIL HiD202*(SK), HiD2030(SK)
Introduction
1Introduction
1.1 General Information
This manual contains information on using the device in control circuits that are
related to functional safety.
The corresponding data sheets, the operating instructions, the system
description, the declaration of conformity, the EC-Type Examination Certificate,
and the applicable certificates (see data sheet) are an integral part of this
document.
The stated documents are available at www.pepperl-fuchs.com or from your
local Pepperl+Fuchs representative.
Mounting, installation, commissioning, operation, maintenance and disassembly
of any devices may only be carried out by trained, qualified personnel. The
instruction manual must be read and understood.
In the event of a device fault, the devices must be taken out of operation and
measures must be taken to protect them against unintentional startup. Devices
may be repaired only by the manufacturer. Deactivating or bypassing safety
functions, or failing to observe the instructions in this manual (which lead to faults
or affect the safety functions), can damage property and the environment or
cause personal injury, for which Pepperl+Fuchs GmbH accepts no liability.
The devices have been developed, manufactured, and tested according to the
applicable safety standards. The devices may be used only for the applications
described in the instructions under the specified ambient conditions and
exclusively in connection with the approved peripherals.
1.2 Intended Use
General
These isolated barriers are used for intrinsic safety applications.
The devices supply 2-wire SMART transmitters in the hazardous area and repeat
the current signal from the SMART transmitter to drive a safe area load.
Bi-directional communication is supported for SMART transmitters that use
current modulation to transmit data and voltage modulation to receive data.
The versions without SK provide active outputs that can be configured as current
or voltage output (supplied internally). The versions ending with SK are designed
to provide a sink mode current output on the safe area terminals (supplied
externally). While HiD2025(SK) and HiD2029(SK) are one channel versions, the
HiD2026(SK) and the HiD2030(SK) provide two channels.
The devices are mounted on a HiD Termination Board.
Safety Manual SIL HiD202*(SK), HiD2030(SK)

Safety Manual SIL HiD202*(SK), HiD2030(SK)
Introduction
2014-05
5
HiD2025(SK), HiD2026(SK)
The output is isolated from the input and referenced to the power supply
common.
HiD2029(SK), HiD2030(SK)
These devices can also be used with 2-wire current sources.
A separate fault indication output on the bus indicates that the input signal is
outside the range 0.2 mA ... 24 mA. The fault conditions can be monitored via a
Fault Indication Board.
1.3 Manufacturer Information
Pepperl+Fuchs GmbH
Lilienthalstrasse 200, 68307 Mannheim, Germany
1.4 Relevant Standards and Directives
Device specific standards and directives
Functional safety IEC 61508 part 2, edition 2000:
Standard of functional safety of electrical/electronic/programmable electronic
safety-related systems (product manufacturer)
Electromagnetic compatibility:
- EN 61326-1:2006
- NE 21:2006
System specific standards and directives
Functional safety IEC 61511 part 1, edition 2003:
Standard of functional safety: safety instrumented systems for the process
industry sector (user)
Up to SIL2 HiD2025(SK)
HiD2026(SK)
HiD2029(SK)
HiD2030(SK)

2014-05
6
Safety Manual SIL HiD202*(SK), HiD2030(SK)
Planning
2 Planning
2.1 System Structure
2.1.1 Low Demand Mode of Operation
If there are two loops, one for the standard operation and another one for the
functional safety, then usually the demand rate for the safety loop is assumed to
be less than once per year.
The relevant safety parameters to be verified are:
the PFDavg value (average Probability of Failure on Demand) and the Tproof
value (proof test interval that has a direct impact on the PFDavg)
the SFF value (Safe Failure Fraction)
the HFT architecture (Hardware Fault Tolerance)
2.1.2 High Demand or Continuous Mode of Operation
If there is only one loop, which combines the standard operation and safety
related operation, then usually the demand rate for this loop is assumed to be
higher than once per year.
The relevant safety parameters to be verified are:
the PFH value (Probability of dangerous Failure per Hour)
Fault reaction time of the safety system
the SFF value (Safe Failure Fraction)
the HFT architecture (Hardware Fault Tolerance architecture)
2.1.3 Safe Failure Fraction
The safe failure fraction describes the ratio of all safe failures and dangerous
detected failures to the total failure rate.
SFF = (s+ dd) / (s+ dd + du)
A safe failure fraction as defined in EN 61508 is only relevant for elements or
(sub)systems in a complete safety loop. The device under consideration is
always part of a safety loop but is not regarded as a complete element or
subsystem.
For calculating the SIL of a safety loop it is necessary to evaluate the safe failure
fraction of elements, subsystems and the complete system, but not of a single
device.
Nevertheless the SFF of the device is given in this document for reference.
Safety Manual SIL HiD202*(SK), HiD2030(SK)

Safety Manual SIL HiD202*(SK), HiD2030(SK)
Planning
2014-05
7
2.2 Assumptions
The following assumptions have been made during the FMEDA analysis:
Only one input and one output are part of the considered safety function
(only 2-channel version).
Failure rate based on the Siemens SN29500 data base.
Failure rates are constant, wear out mechanisms are not included.
External power supply failure rates are not included.
The safety-related device is considered to be of type Acomponents with a
Hardware Fault Tolerance of 0.
It is assumed that the device will be used under average industrial ambient
conditions, which are comparable with the classification "stationary mounted"
in MIL-HDBK-217F. Alternatively, the following ambient conditions are
assumed:
• IEC 60654-1 Class C (sheltered location) with temperature limits in the
range of the manufacturer's specifications and an average temperature
of 40 ºC over a long period. A moisture level within the manufacturer's
specifications is assumed. For a higher average temperature of 60 ºC,
the failure rates must be multiplied by a factor of 2.5 based on empirical
values. A similar multiplier must be used if frequent temperature
fluctuations are expected.
It is assumed that any safe failures that occur (e.g., output in safe condition)
will be corrected within eight hours (e.g., correction of a sensor fault).
While the device is being repaired, measures must be taken to maintain the
safety function (e.g., by using a replacement device).
The separate fault indication output of the HiD2029(SK) and HiD2030(SK)
devices is not considered within the FMEDA.
The application program in the programmable logic controller (PLC) is
configured to detect underrange and overrange failures.
The device shall claim less than 10 % of the total failure budget for a SIL2
safety loop.
For a SIL2 application operating in Low Demand Mode the total PFDavg value
of the SIF (Safety Instrumented Function) should be smaller than 10-2, hence
the maximum allowable PFDavg value would then be 10-3.
For a SIL2 application operating in High Demand Mode of operation the total
PFH value of the SIF should be smaller than 10-6 per hour, hence the
maximum allowable PFH value would then be 10-7 per hour.
Since the loop has a Hardware Fault Tolerance of 0and it is a type A
component, the SFF must be > 60 % according to table 2 of IEC 61508-2 for a
SIL2 (sub)system.

2014-05
8
Safety Manual SIL HiD202*(SK), HiD2030(SK)
Planning
2.3 Safety Function and Safe State
Safety Function
The safety function of the devices is the transfer of the analog signals from the
input to the output with a tolerance of 2 %.
Safe State
The user must ensure that the ESD system reacts adequately when the outputs
are outside the range of 4 mA ... 20 mA for a current output or 1 V ... 5 V for a
voltage output.
Reaction Time
The reaction time for all safety functions is < 20 ms.
Input signals Output signals
0/4 mA …20 mA 0/4 mA ... 20 mA
0/4 mA …20 mA 0/1 V …5 V
Table 2.1

Safety Manual SIL HiD202*(SK), HiD2030(SK)
Planning
2014-05
9
2.4 Characteristic Safety Values
HiD2025, HiD2026
Parameters acc. to IEC 61508 Values
Assessment type FMEDA report
Device type A
Demand mode Low Demand Mode or High Demand Mode
Safety function 2Transfer of analog values
HFT 0
SIL 2
s1216 FIT
dd 0 FIT
du 92 FIT
no effect2112 FIT
not part 7.1 FIT
total (safety function) 308 FIT
SFF 70 %
MTBF 3362 years
PFH 9.2 x 10-8 1/h
PFDavg for Tproof = 1 year 4.04 x 10-4
PFDavg for Tproof = 2 years 8.07 x 10-4
PFDavg for Tproof = 5 years 2.02 x 10-3
1"Not considered" failures are considered 50 % as dangerous undetected failures du and 50 % as safe
detected failures.
2"No effect" failures are not influencing the safety functions and are therefore added to the s.
3acc. to SN29500. This value includes failures which are not part of the safety function.
Table 2.2

2014-05
10
Safety Manual SIL HiD202*(SK), HiD2030(SK)
Planning
HiD2025SK, HiD2026SK
Parameters acc. to IEC 61508 Values
Assessment type FMEDA report
Device type A
Demand mode Low Demand Mode or High Demand Mode
Safety function 2Transfer of analog values
HFT 0
SIL 2
s1228 FIT
dd 0 FIT
du 93 FIT
no effect2117 FIT
not part 7.1 FIT
total (safety function) 321 FIT
SFF 70 %
MTBF 3348 years
PFH 9.3 x 10-8 1/h
PFDavg for Tproof = 1 year 4.09 x 10-4
PFDavg for Tproof = 2 years 8.18 x 10-4
PFDavg for Tproof = 5 years 2.04 x 10-3
1"Not considered" failures are considered 50 % as dangerous undetected failures du and 50 % as safe
detected failures.
2"No effect" failures are not influencing the safety functions and are therefore added to the s.
3acc. to SN29500. This value includes failures which are not part of the safety function.
Table 2.3