Det-Tronics Multispectrum IR Flame Detector X3301 Safety Manual

SAFETY MANUAL Multispectrum IR Flame Detector X3301 SAFETY-CERTIFIED MODEL X3301 MULTISPECTRUM INFRARED DETECTOR QUALITY POLICY STATEMENT All quality assurance control measures necessary for safety management as specified in IEC 61508 Part 1 have been implemented. The quality management system of Det‑Tronics is based on the requirements of EN ISO 9001 and ANSI/ASQC Q9001 through the application of the United Technologies Company Achieving Competitive Excellence (ACE) program. In addition, the Quality Management System complies with the European ATEX Directive requirements per EN 13980, the International Electrotechnical Commission requirements per OD005/V2, and the supervised testing requirements per ISO 17025. This manual addresses the specific requirements and recommendations applicable to the proper installation, operation, and maintenance of all Safety‑Certified (SIL‑Certified) X3301 Multispectrum Infrared Flame Detectors. The safety function of the X3301 is to detect a variety of fires and to provide present alarm status to its relay, analog or LON outputs. For complete information regarding performance, installation, operation, maintenance, and specifications, refer to instruction manual 95-8704. 1.1 ©Detector Electronics Corporation 2015 1 Rev: 1/15 95-8720 When using the 0‑20 mA output with HART as a safety output, it is required that Write Protect be set to “on” to ensure that the HART is non‑interfering. SAFETY MESSAGES Procedures and instructions in this section may require special precautions to ensure the safety of personnel performing the operations. Information that raises potential safety issues is indicated by the word “Warning”. Always read and understand these safety messages. NOTE All configuration changes to the X3301 must be verified by the user via a proof test, power cycle and re-check of settings, or other appropriate method. WARNING The X3301 is intended for use in hazardous environments that may include explosive levels of flammable gases and vapors. This product must be properly installed, operated and maintained. Improper installation or use could result in an explosion or fire resulting in death or serious injury. • Do not remove the detector cover in explosive environments when device power is on and circuits are live. • Detector must be properly installed, and wiring compartment cover must be fully engaged to meet hazardous area explosion-proof/ nonincendive requirements. The EQP model is designed for use exclusively with the Det‑Tronics Eagle Quantum Premier system. The detector communicates with the system controller over a digital communication network or EQPSL/SLC (Eagle Quantum Premier Safety Loop / Signalling Line Circuit). The EQPSL/SLC is a fault tolerant, two wire digital communication network arranged in a loop configuration. Analog and relay outputs are not available on this model. For information regarding the use of the SIL 2 Certified X3301 in an EQP system, refer to the EQP Safety Manual 95‑8599. The X3301 is designed for operation with a supply voltage from 18‑30 volts DC. Proper operation outside this range cannot be assumed. Safety‑Certification of the X3301 includes: • Analog Output • Relay Output • EQP LON Output version for X3301 only HART Output as non-interfering • xWatch Surveillance Camera output as non-interfering* DESIGN The X3301 is a multispectrum infrared flame detector that is classified as a Type B smart device according to IEC61508. The standard model provides an isolated 4‑wire, 0‑20 mA output, together with on‑board Alarm and Fault relay contacts. These outputs serve to indicate normal operating condition of the detector, fault, or the presence of a flame alarm. The X3301 contains extensive self‑diagnostics and is programmed to send the current output to a specified state (1 mA, 2 mA or 3 mA) upon internal detection of a failure or fault condition. Safety‑Certification of the X3301 does not include: Pulse Output RS-485 Modbus signal * HART communication is available as an option. The HART option allows the operator to monitor the status of the detector, determine factory settings, adjust field settings, and initiate field tests. For complete information regarding HART communication, refer to the HART Addendum 95‑8577. 1.1 2 The xWatch Surveillance Camera has been evaluated as a non‑interfering device and is approved for use with a Safety‑Certified X3301. The xWatch camera can be attached directly to the X3301 through a factory installed integral connection adapter. The addition of the xWatch does not affect the safety performance of the X3301. Refer to manual number 95‑8603 for details regarding the xWatch camera. 95-8720 VALID INPUT RANGE INSTALLATION X3301 fault annunciation is provided on the 0‑20 mA signal output loop by signaling to a 1 mA, 2 mA, or 3 mA current output level. The receiving device must be programmed to indicate a fault condition when current levels reach over‑current (≥ 21 mA) or undercurrent (≤ 3.6 mA). NOTE For complete information regarding per formance, installation, operation, maintenance and specifications, refer to instruction manual 95-8704. Tools Required: • 14 mm hexagonal wrench DIAGNOSTIC RESPONSE TIME NOTE The X3301 analog signal and relay outputs are not safety-rated during detector warmup or signal output loop testing (including proof testing). Alternative means should be used at the job site to ensure facility safety during these activities. No special installation requirements exist above and beyond the standard installation practices documented in the instruction manual. Environmental specification limits are also as published in the general specifications section in the instruction manual. The X3301 will perform all critical diagnostic functions within 58 minutes, worst case diagnostic detection time. The user must not configure the automatic oi test interval and failure annunciation count combination to be greater than 58 minutes (default setting is one minute intervals, with failure annunciation after three failed oi tests). The operating power distribution system must be designed and installed so the terminal voltage does not drop below 18 Vdc when measured at any specific location. The maximum current limit must be less than 2 amperes. The external system providing power to the X3301 must have overvoltage protection that ensures supply voltage does not exceed 33 Vdc. OPTICAL INTEGRITY TEST The oi test is designed to generate a fault when the unit’s detection range has been reduced by 50% or more. This factor should be carefully considered during detector placement with regard to the required safety function. CERTIFICATION The X3301 Safety‑Certified version is certified to IEC61508:2010 for single input use in low demand SIL 2 Safety Instrumented Systems. SAFETY-CERTIFIED PRODUCT IDENTIFICATION Safety Certification of all X3301 models meeting SIL 2 safety standards is clearly identified on the product label. 1.1 3 95-8720 Common Misuse Scenarios START-UP AND COMMISSIONING Refer to the General Application Information section of the instruction manual for detailed information on common misuse scenarios. Application environment considerations include the following: All safety functions of the X3301 are active within 30 seconds of power‑up without any user action required. • Intense IR sources should not be present in detection area. The Safety Certified X3301 Flame Detector can be commissioned by any qualified person with knowledge of flame detection instruments and the configuration device being used. Refer to the Start‑Up section provided in the instruction manual. Commissioning Personnel NOTE The above scenarios will cause the X3301 relay or 4-20 mA outputs to annunciate a high background fault and/or false alarm depending on the intensity of the radiation and the relay configuration. Relay Configuration Requirements The end user must provide transient and current limiting on the output contacts of the relays. The maximum relay contact output must be limited to 2 amperes at 30 Vdc. The load must be a resistive load. The user must protect against transients by using standard protection methods such as proper grounding of shielded wire and separation of relay load wires from other lines carrying rapidly switched high current (e.g. large motor power supply lines). • Glass and Plexiglas windows attenuate radiation and should not be located between the detector and detection area. • The detector must have a direct line-of-sight to any potential flame source in the detection area. Care must be taken to keep physical obstructions out of the line of view of the detector. If the 0‑20 mA analog output is not being monitored for fault conditions, the status of the Fault relay must be monitored and appropriate action taken. The fault relay is configured for normally energized operation. • The multispectrum IR flame detectors are to be installed in locations where the risk of mechanical damage is low. NOTE If the user suspects that damage or misuse has occurred to the X3301, a full proof test shall be performed. NOTE The black plastic shipping cap must be removed prior to placing the detector into service. 1.1 4 95-8720 Configuration OPERATION, MAINTENANCE, INSPECTION AND PROOF TESTING Digital communication with the X3301 can be used to monitor internal status and to modify the factory settings. For specific information regarding HART communication, refer to the HART Addendum 95‑8577. Tools Required: • Magnetic oi test tool (p/n 102740‑002) • Window cleaner (p/n 001680-001 or isopropanol) • Lens tissue and cotton swabs • 4 mm flat blade screwdriver NOTE Prior to device configuration (setting alarm thresholds, latch/non-latch function, etc.) all alarm outputs must be bypassed. The device is not safety certified during configuration change activities. After normal installation and start‑up have been completed as recommended within the instruction manual, Proof Tests must be performed for every Safety‑Certified X3301 detector installed. NOTE All configuration changes to the X3301 must be verified by the user via a proof test, power cycle and re-check of settings, or other appropriate method. The LED flash rate during power-up should be checked to verify proper setting. Personnel performing Proof Test procedures shall be competent to perform the task. All Proof Test results must be recorded and analyzed. Any corrective actions taken must be documented in the event that an error is found in the safety functionality. The Proof Tests must be performed at a frequency as shown in Table 1. Configuration Protection WARNING Failure to perform the specified testing and inspection may lower or void the SIL rating for the product or system. When using the 0‑20 mA output with HART as a safety output, it is required that Write Protect be set to “on” to ensure that the HART is non‑interfering. If HART Write Protect is temporarily disabled, the user must take specific action to re‑enable Write Protect to ensure that HART communication remains non‑interfering. Table 1—Frequency of Proof Tests Proof Test Name Commissioning Frequency Visual Field Inspection Proof Test Yes As needed, depending on level and type of contaminants present Detector Response Mag oi Proof Test Yes Yearly 1.1 5 95-8720 VISUAL FIELD INSPECTION PROOF TEST FAULT/FAILURE ACTION PLAN Visual inspection of all Safety‑Certified X3301 Flame Detectors shall be conducted as needed to confirm that there are no obstructions in the optical field of view. Corrective action will include removal of such impediments should they exist. In the event of a non‑alarm condition result with the Mag oi test, the standard Maintenance and Troubleshooting procedures listed in the X3301 instruction manual must be followed. In the event that the condition cannot be resolved, the standard Device Repair and Return procedures listed in the X3301 instruction manual must be followed. Completion of Visual Field Inspection Proof test will be recorded and documented in the SIS logbook. Any and all failures to successfully complete the alarm test must be recorded and documented in the SIS logbook. DETECTOR RESPONSE PROOF TEST WARNING Any external alarm equipment, systems or signaling devices that could be automatically initiated by performing this test must be disabled or bypassed before performing this test! WARNING Any external alarm equipment, systems or signaling devices that were disabled must be re-activated at the conclusion of proof testing activities. Tools Required: • Magnetic oi test tool (part number 102740‑002), HART Communicator, or hard wire trigger capability PRODUCT REPAIR The X3301 is not field‑repairable, and any internal device repairs must be conducted at the factory. No firmware changes are permitted or authorized. All failures indicated by internal diagnostics or Proof Tests that cannot be resolved through the troubleshooting and maintenance procedures described in the X3301 manual must be reported to the manufacturer. All flame detectors must be performance tested using the Magnetic oi / Manual oi Procedure and inspected to ensure that they are capable of providing expected performance and protection. Manual oi tests may be initiated via hard wire trigger or HART communication. Note that the Mag oi Procedure and Manual oi Tests are not interference free. During these tests the unit is not performing normal flame detection functions. Model X3301 provides an onboard status LED, which indicates Green color when internal operational parameters are normal. See instruction or HART manuals for details on performing Mag and Manual oi tests. OPERATING, ENVIRONMENTAL AND PERFORMANCE SPECIFICATIONS The operating temperature range for the Safety Certified X3301 is –40°C to +75°C. The Safety‑Certified X3301 product versions fully comply with, and must be operated in accordance with the functional and performance specifications provided in the instruction manual. A 24 hour mean time to repair should be assumed for safety availability calculations. To indicate a successful proof test, the LED changes to a red color, the Alarm and Auxiliary relays change state to indicate an alarm condition, and the current output indicates 20 mA. These results should be verified on the control device. SPARE PARTS Refer to the spare parts section of the X3301 manual. Safety certification is based on a sufficient number of spares to achieve a 24 hour mean time to repair. To indicate an unsuccessful proof test, the LED changes to yellow, the Fault relay becomes de‑energized, and the current output indicates 2 mA. The fault indication can be reset by momentarily applying the magnet or manual oi switch. 1.1 6 95-8720 CERTIFICATION AND FAILURE RATE DATA Product Certifications All Safety‑Certified X3301 models are certified compliant to: FM ® APPROVED IEC61508: 2010 Type B Device FM, CSA, ATEX, CE, exida, and others. Refer to the X3301 Instruction Manual for details. Systematic Capability: SIL 2 certified FMEDA Report available. HFT: 0 For complete information regarding performance, installation, operation, maintenance, and specifications, refer to the instruction manual: Low Demand Mode PFDavg should be calculated for any safety instrumented function using the X3301. (Refer to FMEDA report for necessary information, including DU rate). X3301 95‑8704 Safety Accuracy: Not applicable. Safety Response Time: See appendix A of the instruction manual for response time details. Product Life: 13‑22 years, based on manufacturer data. All failure rate data for SIL verification is in the FMEDA report, which is available upon request. IEC 61508 Failure Rates in FIT1 Failure Category lsd lsu2 ldd ldu SFF3 X3301 IR Flame Detector, Analog Output 0 FIT 115 FIT 921 FIT 74 FIT 92.1% X3301 IR Flame Detector, Relay Output 404 FIT 129 FIT 488 FIT 88 FIT 93.3% X3301 IR Flame Detector, Analog Output with HART 0 FIT 120 FIT 1147 FIT 93 FIT 93.2% 1 FIT = 1 Failure / 109 Hours 2 It is important to realize that the No Effect failures are no longer included in the Safe Undetected failure category according to IEC 61508, ed2, 2010. 3 Safe Failure Fraction needs to be calculated on (sub)system level. 1.1 7 95-8720 TERMS AND DEFINITIONS EQP Eagle Quantum Premier System EQPSL/SLC Eagle Quantum Premier Safety Loop / Signaling Line Circuit FMEDA Failure Mode Effects and Diagnostics Analysis HART Highway Addressable Remote Transducer HFT Hardware Fault Tolerance PFD Probability of Failure on Demand (Probability of Dangerous Failure) PFDavg Average Probability of Failure on Demand SFF Safe Failure Fraction SIF Safety Instrumented Function SIL Safety Integrity Level SIS Safety Instrumented System X3301 Multispectrum IR Flame Detector 1.1 8 95-8720