EATON MTL454 Series Analogue Input Module

INTRODUZIONE

• The Analogue Input module types MTLx541A/MTLx541AS (single channel) and MTLx544A/MTLx544AS(dual channel) are intrinsic safety isolators that interface with process measurement transmitters located in a hazardous area of a process plant.
• They are also designed and assessed according to IEC 61508 for use in safety instrumented systems up to SIL 2.
• The MTLx541A provides an input for a separately-powered 4/20mA transmitter located in a hazardous area, and repeats the transmitter current into a load in the safe area. The MTLx544A supports two identical channels for use with two separate transmitters.
• The MTLx541AS and MTLx544AS versions act as a current sink for the safe area connection rather than driving the current into the load.
• All the modules allow bi–bi-directional transmission of HART communication signals superimposed on the 4/20mA loop current, so that the transmitter can be interrogated either from the operator station or by a hand-held communicator (HHC).
• There are no configuration switches or operator controls to be set on the modules. These modules are members of the MTL4500 and MTL5500 range of products.

Variant Description

• Functionally, the MTL4500 and MTL5500 range of modules are the same, but differ in the following way:
  • The MTL4500 modules are designed for backplane-mounted applications
  • The MTL5500 modules are designed for DIN-rail mounting.
• In both models, the hazardous area field-wiring connections (terminals 1,2, and optionally 4,5) are made through the removable blue connectors, but the safe area and power connections for the MTL454xA/MTL454xAS modules are made through the connector on the base, while the MTL554xA/MTL554xAS modules use the removable grey connectors on the top and side of the module.

Nota that the safe-area connection terminal numbers differ between the backplane and the DIN-rail mounting models.

• The analogue input models covered by this manual are:

Nota: To avoid repetition, further use of MTLx54xA and MTLx54xAS in this document can be understood to include both DIN-rail and backplane models. Individual model numbers will be used only where there is a need to distinguish between them.

• All the module types described in this manual have the same connectivity for the field signals, supporting 4-wire process transmitters or currents sourced in the hazardous area.
• The connection of the repeated current signals into the input measurement channels for the safety logic system follows the arrangement shown in the following diagram.
• When the input channels of the Safety Instrumented System (SIS) are providing power for the loop, the ‘S’ variants of the isolator modules are used to ‘sink’ the measuring current.
• In the other cases the isolator modules ‘source’ the measuring current that flows into a load resistor inside the input card of the Safety Instrumented System.

Product build revisions covered by this manual

• The information provided in this manual is valid for the product build revisions listed in the following table:

• The product build revision is identified by the field ‘CC’ in the module Product Identification Number that appears at the bottom left-hand corner of the side label:
• The CC field immediately precedes the 7-digit Serial Number field, DDDDDDD. Exampon:

Configurazione del sistema

An MTLx54x module may be used in single-channel (1oo1) safety functions up to SIL 2. The worked example in this manual is for a SIL 2 application.
The figure below shows the system configuration and specifies detailed interfaces to the safety-related and non-safety-related system components. It does not aim to show all details of the internal module structure, but is intended to support understanding for the application.

• The MTLx54xA/MTLx54xAS modules are designed to receive an active 4-20mA signal from separately powered process transmitters in the hazardous area and to repeat the current flowing in the field loop to the safe-area load.
• The shaded area indicates the safety-related system connection, while the power supply connections are not safety-related. The term ‘Logic Solver’ has been used to denote the safety system performing the monitoring function of the process loop variable.

Nota: When using the MTLx544A/MTLx544AS dual-channel modules, it is not appropriate for both channels to be used in the same loop or the same safety function, as this creates concerns regarding common-cause failures.

• Consideration must also be given to the effect of common-cause failures when both loops of a dual-channel module are used for different safety functions.

Associated System Components

• There are many parallels between the loop components that must be assessed for intrinsic safety as well as functional safety.
• In both situations, the contribution of each part is considered in relation to the whole.
• The MTLx54xA/MTLx54xAS modules are components in the signal path between safety-related process transmitters and safety-related control systems.
• The transmitter or other field device must be suitable for the process and have been assessed and independently verified for use in functional safety applications.
• The field instrument and Analog input card of the Logic Solver shall have a normal operating range of 4-20mA, but be capable of working over an extended range of 3 to 22mA for under- and over-range.
• The Logic Solver shall have the ability to detect and annunciate input currents higher than the threshold of 21mA and lower than the threshold of 3.6mA to determine out-of-range conditions.

Nota that the transmission of HART data is not considered as part of the safety function and is excluded from this analysis.

• However, for HART data communication to take place, the input impedance of the receiving equipment must be at least 240R.

Selection of product and implications

• The safe area output signal from the MTLx541A/AS and MTLx544A/AS modules is within the operating range of 4-20mA under normal conditions. If the field wiring to the transmitter or the connection between the isolator and logic solver is open-circuit, then the loop current will fall to less than 3.6mA and close to zero.
• If the field wiring connection between the transmitter and isolator is short-circuited, the loop current will also fall to below 3.6mA.
• For module types MTLx541A and MTLx544A that source the 4-20mA signal in the safe area circuit, the current seen by the logic solver will fall to less than 3.6mA and close to zero if the connection between the isolator and logic solver is shorted.
• For module types MTLx541AS and MTLx544AS that sink the 4-20mA signal in the safe area circuit, the current seen by the logic solver will rise to a value greater than 21mA if the connection between the isolator and logic solver is shorted.
• In both cases, the fault condition must be detected by the logic solver in Functional Safety applications. This should also include the detection of power supply failure,s which causes the output of the isolator to fall to zero mA.

Valutazione della sicurezza funzionale

Hardware Safety Integrity

• The hardware assessment shows that MTLx541A/MTLx541AS and MTLx544A/MTLx544AS modules:
• have a hardware fault tolerance (HFT) of 0
• are classified as Type A devices (“non-complex” component with well-defined failure modes)
• have no internal diagnostic elements

The failure rates of these modules at an ambient temperature of 45°C are as follows:

• Reliability data for this analysis is taken from IEC TR 62380:2004, Reliability Data Handbook.
• Failure mode distributions are taken principally from IEC 62061:2005 Safety of Machinery.
• Stated failure rates for dual-channel modules apply to a single channel.

It is assumed that the module is powered from a nominal 24V DC supply and operating at a maximum ambient temperature of 45°C.

• Systematic Safety Integrity
  • The MTLx54x modules have a systematic safety integrity measure of SC 2. This has been established using compliance Route 1S, as described in IEC 61508-2: 2010, section 7.4.2.2 c.
• Capacità SIL
  • Considering both the hardware safety integrity and the systematic capability, this allows the modules to be used in safety functions up to SIL 2 in a simplex architecture (HFT=0), provided SFF ≥60% is the case for the application.
  • The hardware safety integrity assessment has been conducted according to compliance Route 1H, as described in IEC 61508-2:2010, section 7.4.4. (See example sotto.)
• Nota:
  • Independent of hardware architecture and systematic capability considerations, the hardware probability of failure for the entire safety function needs to be calculated for the application to ensure the required PFH (for a high or continuous demand safety function) or PFDAVG (for a low demand safety function) for the SIL is met.

Example of use in a safety function

• In questo example, the application context is assumed to be:
  • The safety function is to repeat the current within ±2%
  • The logic solver will diagnose currents above 21mA and below 3.6mA as faults and take appropriate action.

The failure modes shown above can then be defined as:

The failure rates of the MTL4541A and MTL5541A for these categories are then (FITs):

In questo example, the safe failure fraction (SFF) is 84.4%.

is not used in the calculation of SFF. Defining the “output current correct within ±2%” failure mode as
represents a conservative approach to the calculation of SFF. Interpreting this failure mode as su (safe, undetected) may also be considered and yields an SFF value of 87.7%.
Accordingly, the SFF of all module types described in this manual, when used in the same application, are as follows:

Compatibilità elettromagnetica

• The MTL4500 and MTL5500 modules are designed for operation in a normal industrial electromagnetic environ-ment but to support good practice, modules should be mounted without being subjected to undue conducted or radiated interference. See Appendix A for applicable standards and levels.

Ambientale

• The MTL4500 and MTL5500 modules operate over the temperature range from -20°C to +60°C, and at up to 95% non-condensing relative humidity.
• The modules are intended to be mounted in a normal industrial environment without excessive vibration, as specified for the MTL4500 & MTL5500 product ranges. See Appendix A for applicable standards and levels.
• Continued reliable operation will be assured if the exposure to temperature and vibration is within the values given in the specification.

Installazione

Two particular aspects of safety must be considered when installing the MTL4500 or MTL5500 modules, and these are:

• Sicurezza funzionale
• Sicurezza intrinseca

Reference must be made to the relevant sections within the instruction manual for the MTL4500 range (INM4500) or the MTL5500 range (INM5500), which contain basic guides for the installation of the interface equipment to meet the requirements of intrinsic safety. In many countries, there are specific codes of practice, together with industry guidelines, which must also be adhered to.
Provided that these installation requirements are followed, there are no additional factors to meet the needs of applying the products for functional safety use.
To guard against the effects of dust and water, the modules should be mounted in an enclosure providing at least IP54 protection degree, or the location of mounting should provide equivalent protection, such as inside an equipment cabinet.
In applications using the MTL4500 range, where the environment has a high humidity, the mounting backplanes should be specified to include conformal coating.

Manutenzione

• To follow the guidelines about the operation and maintenance of intrinsically safe equipment in a hazardous area, yearly periodic audits of the installation are required by the various codes of practice.
• In addition, proof-testing of the loop operation to conform with functional safety requirements should be carried out at the intervals determined by safety case assessment.
• Proof testing must be carried out according to the application requirements, but it is recommended that this be carried out at least once every three years.
• Refer to Appendix B for the proof testing procedure of the MTLx541A/AS and MTLx544A/AS modules.

Note that there may also be specific requirements laid down in the E/E/PE operational maintenance procedure for the complete installation.

If an MTLx541A/AS and MTLx544A/AS module is found to be faulty during commissioning or during the normal lifetime of the product, then such failures should be reported to the local MTL office.
When appropriate, a Cus-tomer Incident Report (CIR) will be filed by Eaton to enable the return of the unit to the factory for analysis. If the unit is within the warranty period, then a replacement unit will be sent.
Consideration should be given to the service lifetime for a device of this type, which is in the region of ten years.
Operating an MTLx541A/AS and MTLx544A/AS module for longer than this period could invalidate the functional safety analysis, meaning that the overall safety function no longer meets its target SIL.
If high failure rates of the MTL modules are detected, indicating that they have entered the ‘end of life phase’ of their service life, then they should be replaced promptly.

Appendici

Appendix A: Summary of applicable standards

• This annex lists all standards referred to in the previous sections of this document:

Appendice B: Proof Test Procedure, MTLx541A/AS, MTLx544A/AS Modules

• Confirmation, through testing, that a safety function will operate as designed, is a necessary periodic activity to ensure that the probability of failure upon demand (PFDavg) is maintained.
• In some applications, the user may prefer to conduct a proof test on the overall safety instrumented function without dismantling or disconnecting the individual instrumentation components, in order to avoid disturbing the integrity of the installation.
• However, where it is deemed desirable to perform proof testing on the MTL modules individually, the following procedure may be used. Proof tests of the other components of the loop must then be conducted
  in accordance with their manufacturers’ instructions, to maintain the integrity of the overall safety function. Alternative proof tests may be devised and applied, provided they give a similar level of test coverage that is appropriate to the safety function.
• The tests described here – see Figure 7.1 – compare the output current of the MTL isolator with the input current (A1) over the required range of operation, and measure the “error current” i.e. the difference between the two – as indicated on A2. The tests should be employed per channel, as appropriate.
• Ammeter A2 must be capable of measuring currents of either polarity. If it is not an auto-ranging instrument, set it to a high range before switch on, and then adjust sensitivity to obtain the required reading.

Procedura di prova di prova

Sequenza di prova:

1. System – Normal operation test
2. Input /Output characteristic functional safety test
3. System – Normal operation test

System – Normal operation test

• Make sure that the module to be tested is operating normally in the target system, without errors and in an energised mode. If the module is in a faulty or de-energised loop, restore normal fault-free and energised operation before testing.

Input/Output characteristic functional safety test

• Observe normal anti-static precautions when handling equipment during device testing.
• Remove the unit from the target system and connect it as shown in Figure 7.2.
• This figure shows the arrangement for the MTLx541A/AS single-channel modules; for equivalent connections for the MTLx544A/AS dual-channel modules, refer to the relevant product data sheets.
• Note that it is acceptable to leave the unit in the target system but only after ensuring that the all the hazardous area input and safe area output terminals have been disconnected from the system and are available for test. Alternatively, for the backplane-mounted MTL4500 range modules, a separate backplane can be used to provide access to the power and output connections.
• Note that the combination of the 24V power supply and variable resistor RV1 in the hazardous area connection can be provided by a suitable industrial current simulator, which is likely to be more readily available.
• Also, the 250R resistor does not need to be a precision type; any value in the range 200-300R is acceptable would suffice, such as a standard value of 240R.
• Where a second power supply is introduced for testing the MTLx541AS or MTLx544AS module variants, note that both power supplies must be floating and not share a common 0V connection.
• During testing, a 24V nominal system power supply in the range 20.0 to 35.0V should be connected between terminals 13 and 14 (+ve to terminal 14).

Misure
Make the following measurements. It is recommended to record the results in a table such as that shown on the next page.

1. Adjust resistor RV1 to vary the loop current (measured by Ammeter A1) through the range 4 to 20mA.(Tests 1 – 5 in table)
2. The measured current imbalance (measured by Ammeter A2) over this range should not exceed ±50μA.
3. Adjust RV1 to vary the current (A1) to 3.5mA and then 21.5mA (tests 6 & 7 in table).
4. The measured current imbalance (A2) at these currents should not exceed ±200μA.
5. Record the supply voltage Vs.

If appropriate, repeat these measurements for Channel 2.

System – Normal operation test

1. Disconnect the test setup from the unit and reconnect the original system configuration. Make sure that the tested unit operates normally in the target system, as before, without errors and in energised mode.

• Date: ______/______/__________
• Module type: _________________
• Volume di fornituratage Vs: ______________V dc
• Numero di serie: ______________________________

Canale 1

Canale 2

Per maggiori informazioni

If further assistance is required, please contact an authorised MTL Distributor, Sales Office, or Customer Service Department

AUSTRALIA

• Eaton Electrical (Australia) Pty Ltd, 10 Kent Road, Mascot, New South Wales, 2020, Australia
• Tel: +61 1300 308 374 Fax: +61 1300 308 463
• E-mail: mtlsalesanz@eaton.com

INDIA

• MTL India,  No.36, Nehru Street, Off Old Mahabalipuram Road Sholinganallur, Chennai – 600 119, India
• Telefono: +91 (0) 44 24501660 /24501857
• Fax: +91 (0) 44 24501463
• E-mail: mtlindiasales@eaton.com

AMERICHE

• Cooper Crouse-Hinds MTL Inc. 3413 N. Sam Houston Parkway W. Suite 200, Houston TX 77086, USA
• Tel: +1 Numero di telefono: 281-571-8065 Fax: +1 Numero di telefono: 281-571-8069
• E-mail: mtl-us-info@eaton.com

NORVEGIA

• Norex AS Fekjan 7c, Postboks 147,  N-1378 Nesbru, Norway
• Tel: +47 66 77 43 Fax: +80 47 66 84
• E-mail: info@norex.no

Eaton Electric Limited, Great Marlings, Butterfield, Luton, Beds, LU2 8DL, UK.

• Tel: + 44 (0)1582 723633
• Fax: + 44 (0) 1582 422283
• E-mail: mtlenquiry@eaton.com
• www.eaton.com
• 2024 Mangia
• Tutti i diritti riservati
• Publication No. SM4541A/AS, 5541A/AS, 4544A/AS

EUROPA (EMEA):

• +44 (0)1582 723633
• mtlenquiry@eaton.com

LE AMERICHE:

• +1 800 835 7075
• mtl-us-info@eaton.com

ASIA-PACIFICO:

• +65 6 645 9888
• sales.mtlsing@eaton.com
• I dati forniti sono intesi solo come descrizione del prodotto e non devono essere considerati una garanzia legale di proprietà o garanzia. Nell'interesse di ulteriori sviluppi tecnici, ci riserviamo il diritto di apportare modifiche al design.

Connect with Eaton, MTL:

Domande frequenti

Q: Are there any configuration switches on the modules?

A: No, there are no configuration switches or operator controls on the modules. They are designed for ease of use without manual settings.

Q: What is the purpose of the AS versions of the modules?

A: The AS versions act as a current sink for the safe area connection rather than driving the current into the load, providing flexibility in installation.

Documenti / Risorse

EATON MTL454 Series Analogue Input Module [pdf] Manuale di istruzioni MTL4541A, MTL4541AS, MTL5541A, MTL5541AS, MTL4544A, MTL4544AS, MTL5544A, MTL5544AS, MTL454 Series Analogue Input Module, MTL454 Series, Analogue Input Module, Input Module, Module

Riferimenti

• Manuale d'uso