Safety Manual
Series 854 ATG/XTG level gauges
Table of Contents
CHAPTER 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1
1.1 About this Manual . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1
1.1.1 Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1
1.1.2 Content . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1
1.1.3 Related Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1
1.2 Basic Skills and Knowledge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1
1.3 Safety Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2
1.3.1 Safety Instrumented Systems, Functions and Integrity Levels . . . . . . . . . . . 1-2
1.3.2 What standard to use . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2
CHAPTER 2 Functions, Architecture and Compliance . . . . . . . . . . . . . . . . . . . . . . . . . 2-1
2.1 Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-1
2.2 Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-1
2.3 Compliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-1
2.4 Safety-related Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2
2.5 Safety Design. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2
2.6 Principle of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3
2.7 Fault Detection and Reaction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-5
CHAPTER 3 Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1
3.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1
3.2 Assumptions and Constraints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1
3.3 New Installation or Upgrade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1
3.3.1 New Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1
3.3.2 Upgrade. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1
3.4 Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2
3.4.1 Hardware Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2
3.4.2 Software Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-3
3.5 Verification of the Safety Instrumented Function(s) . . . . . . . . . . . . . . . . 3-4
CHAPTER 4 Maintenance Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1
4.1 Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1
4.2 Diagnostic items . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1
4.3 Proof Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-2
Part No.: 4417.808_Rev00
854 ATG/XTG level gauge
Safety Manual
Table of Contents
ii
854 ATG/XTG level gauge
Safety Manual
Part No.: 4417.808_Rev00
Introduction
CHAPTER 1 INTRODUCTION
1.1 About this Manual
1.1.1 Purpose
The Safety Manual provides information about the 854 ATG/XTG level
gauge that is relevant for integration of this servo-based level gauge
into a Safety Instrumented System (SIS). This manual is aimed at
technical personnel responsible for such integration.
1.1.2 Content
Chapter Title
Contents Description
Introduction
This chapter.
Functions, Architecture and
Compliance
Specification of the Safety Instrumented Functions (SIF) that are applied and the
architecture(s) these SIFs need to operate. Furthermore relevant certification and
compliance information is given.
Implementation
Description of - or reference to - details how to achieve and implement the applicable
SIFs.
Maintenance Requirements
Description of - or reference to - details how to maintain the required Safety Integrity
Levels of the implemented SIFs.
1.1.3 Related Documents
IEC 61508 (2010),
IEC 61511 (2004),
Instruction Manual Series 854 ATG level gauge; Part No.: 4416.220,
Installation guide 854 ATG level gauge; Part No.: 4416.225,
Instruction Manual Series 854 XTG level gauge; Part No.: 4416.275,
Installation guide 854 XTG level gauge; Part No.: 4416.276.
1.2 Basic Skills and Knowledge
Before you start to work on the 854 ATG/XTG level gauge it is assumed
that you are certified to do work on safety related systems and devices
(i.e. certified Enraf Service Engineer), and that you have appropriate
knowledge of:
The concepts and functioning of the 854 ATG/XTG level gauge,
The applicable process and equipment under control within the SIS,
This Safety Manual,
Site procedures,
Applicable safety standards (e.g. IEC 61508 and IEC 61511).
Part No.: 4417.808_Rev00
854 ATG/XTG level gauge
Safety Manual
1-1
Introduction
1.3 Safety Standards
1.3.1 Safety Instrumented Systems, Functions and Integrity Levels
Processes and Equipment Under Control (PUC/EUC) in the process
industry require a high level of safety. Safety Instrumented Systems
(SIS) are used to perform Safety Instrumented Functions (SIF).
Instrumentation that is used for SIFs, must meet minimum standards
and performance levels. Standards like IEC 61508 and IEC 61511 have
been developed for this purpose. One of the performance criteria that
these standards apply is the Safety Integrity Level (SIL).
IEC 61508 details the design requirements for achieving the required
SIL. The safety integrity requirements for each individual safety function
may differ. The safety function and SIL requirements are derived from
hazard analyses and risk assessments. The higher the level of adapted
safety integrity, the lower the likelihood of dangerous failure of the SIS.
These standards also address the safety-related sensors and final
elements regardless of the technology used.
The 854 ATG/XTG level gauge can be used for a specific SIF that
demands SIL 1 or SIL 2. If used in a redundant arrangement, the 854
ATG/XTG level gauge can be applied in loops that require SIL 3.
1.3.2 What standard to use
IEC 61508 has been developed as a generic standard. A framework of
standards, incl. IEC 61511, for specific industry sectors were based on
this one. The information in the table below is meant as a guideline.
Standard
Typical application within the process industry
IEC 61508
If you are a manufacturer, it is strongly recommended that you apply the IEC 61508.
Functional safety of electrical /
electronic / programmable
electronic (E/E/PE) safetyrelated systems
This generic standard is intended to provide guidance on how to develop E/E/PE
safety-related devices as used in Safety Instrumented Systems (SIS).
The IEC 61508 serves as a basis for the development of sector standards (e.g. for
the machinery sector, the process sector, the nuclear sector, etc.).
It can serve as stand-alone standard for those sectors where a sector specific
standard does not exist.
IEC 61511
If you are an owner/user, it is strongly recommended that you apply the IEC 61511.
Functional safety - Safety
instrumented systems for the
process industry sector
This standard addresses the application of SISs for the process industries. It requires
a process hazard and risk assessment to be carried out, to enable the specification
for SISs to be derived.
In this standard a SIS includes all components and subsystems necessary to carry
out the safety instrumented function from sensor(s) to final element(s).
The standard is intended to lead to a high level of consistency in underlying
principles, terminology and information within the process industries.
This should have both safety and economic benefits.
1-2
854 ATG/XTG level gauge
Safety Manual
Part No.: 4417.808_Rev00
Functions, Architecture and Compliance
CHAPTER 2 FUNCTIONS, ARCHITECTURE AND COMPLIANCE
2.1 Functions
Beside its standard functions the 854 ATG/XTG level gauge can also be
used for a Safety Instrumented Function (SIF) for storage tanks in the
oil and gas industry. This function is:
the SIL compliant overfill protection.
To establish that the safety parameters for this function of the 854 ATG/
XTG level gauge are in the range of SIL 2, it is necessary to:
use the correct architecture; see chapter 2.2 "Architecture",
apply the function correctly; for further details see,
chapter 3 "Implementation",
chapter 4 "Maintenance Requirements".
2.2 Architecture
Overfill protection in the range of SIL 2 for the 854 ATG/XTG level
gauge can be established with the standard architecture. However,
specific hardware and software requirements do apply; for further
details see chapter 3.4 "Configuration".
2.3 Compliance
Organization
Relevant details
The 854 ATG/XTG level gauge is considered to be a Type A system in the meaning of
IEC 61508. If implemented and maintained correctly, the safety parameters for the
overfill protection are in the range of SIL 2.
Details of the assessment and cerfitication by TUV Rheinland are recorded in:
Report No. W 56 2009 S 1.
Certificate No. W 56 2010 C4-1.
Part No.: 4417.808_Rev00
854 ATG/XTG level gauge
Safety Manual
2-1
Functions, Architecture and Compliance
2.4 Safety-related Data
The table below specifies the applicable data relating to IEC 61508:
Entity / parameter
Value
Remarks
Safety Integrity Level
SIL 2
As single channel safety related subsystem.
With a structure establishing a hardware fault
tolerance of 1 the device is usable in SIL 3
applications.
Classification of the device
Type A
Mode of operation
High demand mode
Continuous operation
Confidence level
1-
= 70 %
Hardware fault tolerance
HFT
Diagnostic coverage
DC
90 %
Safe Failure Fraction (SFF)
SFF =
99.4 % *
Probability of Failure per Hour
PFH =
9.71E-08 1/h
MTBF dangerous failures
MTBFD
1.03E07 h
1173 y
Dangerous failure rate
D =
9.71E-08 1/h
97.1 FIT
Safe failure rate
D =
1.61E-05 1/h
1387 FIT
Proof Test Interval
T=
5y
Once every 5 years.
*) The SFF takes into account the failure detection
provided by the electronic and software components of
the device.
TABLE 2-1
Safety-related data
2.5 Safety Design
The basic 854 ATG/XTG level gauge is used for overfill protection,
although this is not a SIL compliant function. To establish SIL compliant
overfill protection a dedicated test has been developed to prove that
the gauge is able to measure an upward movement of the product. This
test is called the Servo Auto Test 1, and can be executed automatically
at a user defined interval. It can also be prompted by a dedicated
command for Proof Test purposes. Provided the required configuration
is established, the user can set this test to application needs.
1. The Servo Auto Test feature is
patent pending.
2-2
854 ATG/XTG level gauge
Safety Manual
Part No.: 4417.808_Rev00
Functions, Architecture and Compliance
The Servo Auto Test makes use of the existing Principle of
measurement as described in the Instruction Manual, and has the
following features:
it is executed automatically and autonomously,
it is executed immediately after tank loading, as this is a critical
moment,
it is executed at regular intervals to prove that the moving parts of the
gauge can move as intended,
in case of a detected failure,
the appropriate alarm is initiated,
the applicable hardware relays are activated/de-activated
(depending on the mode),
during execution the effects of the test are hidden,
i.e. level, status and relays,
for installed equipment (e.g. CIUs) and systems,
the installed base can be upgraded (for applicable prerequisites see
chapter 3.3 "New Installation or Upgrade").
2.6 Principle of Operation
Starting from the situation that the displacer (D) is in rest at the product
level (PL), the Servo Auto Test consists of these basic steps:
1.
The displacer is raised over
a configurable distance
(cd).
2.
The wire tension (wt) is
measured while the
displacer is being raised.
3.
Appropriate actions are
initiated, only in case the
wire tension exceeds the
predetermined limit (X)
caused by a mechanical
obstruction.
4.
The displacer is lowered to
the product level.
NOTE: The duration of a Servo Auto Test mainly depends on
the configuration settings.
A typical Servo Auto Test running at default settings
may take approximately 15 seconds.
Part No.: 4417.808_Rev00
854 ATG/XTG level gauge
Safety Manual
2-3
Functions, Architecture and Compliance
FIGURE 2-1 shows a graph that represents the actual and measured
product levels. The latter in fact is the level of the displacer.
The displacer level correctly follows the actual product level, while at set
intervals a Servo Auto Test occurs. This indicates that the level gauge is
in a healthy state and the moving parts of the gauge can move as
intended.
The Servo Auto Test occurences take place at a set interval when the
product level is stable, or assumed to be stable. This is the case at
product levels PL1 and PL2. During tank filling the Servo Auto Test is
temporarily disabled. After end of filling is detected a certain time lapse
(tl) passes 1 before the Servo Auto Test is started again. Afterwards
Servo Auto Test occurences take place at the set interval again.
The product level (PL) is shown as a function of time
where PL1 is the initial stable level and PL2 is the stable
level after the tank was filled.
FIGURE 2-1
Servo Auto Test occurences
1. For details about parameters and settings
refer to chapter 3.4.2 "Software Configuration"
2-4
854 ATG/XTG level gauge
Safety Manual
Part No.: 4417.808_Rev00
Functions, Architecture and Compliance
2.7 Fault Detection and Reaction
During a Servo Auto Test fault detection is conducted as follows:
1. in case the wire tension exceeds its predetermined limit while the
displacer is raised, the displacer cycle is interrupted;
the displacer will be lowered to the product level;
2. a second displacer cycle is started;
in case this cycle is also interrupted the displacer will be lowered to
the product level again;
3. a third displacer cycle is started;
in case this cycle is also interrupted the displacer will remain at the
blocked level;
4. a failure state has now occurred.
Upon a fault detection the 854 ATG/XTG level gauge will initiate fault
reaction as follows:
relevant product levels are set to fail in their corresponding protocol
records (B, D, ZLQ);
other product levels keep their last recorded values (innage, ullage
and corrected product levels),
all product level statuses are set to fail,
data item [ES] (Error SPU request) is set to code 0607 (Servo Auto Test
fail),
relays (if present) are set in accordance with their gauge fail status
configuration,
the displacer is kept at the blocked level,
new gauge servo commands are not executed, unless the gauge is
in maintenance mode.
NOTE: Be aware that the cause of a failure must be
removed before you reset the gauge. Otherwise the
gauge will come into a fail state again.
The fail state of the 854 ATG/XTG level gauge due to a Servo Auto Test
failure ends when one or more of these actions occur:
the user initiates a reset directly via the reset command (item [RS]),
the user initiates a reset indirectly via the exit command (item [EX]),
a power down / power up sequence.
Two typical fault situations exist in which faults are detected as
described above. Figures 2-2 and 2-3 both show a graph that also
represents the actual product level and the displacer level. Each figure
shows a typical situation. They represent identical failure states - under
different conditions - as a result of a mechanical obstruction.
Part No.: 4417.808_Rev00
854 ATG/XTG level gauge
Safety Manual
2-5
Functions, Architecture and Compliance
FIGURE 2-2 shows fault situation 1 (FS1). The product level is raising
due to tank filling. Before it actually stops, end of filling is detected. After
a certain time lapse (for details see 3.4.2) a Servo Auto Test is initiated
and the wire tension exceeds the limit in three subsequent attempts.
One of the results of the fault reaction is that filling is stopped. In this
situation PL2 represents the intended product level after filling.
FIGURE 2-2
Failure State example - during tank filling
FIGURE 2-3 shows fault situation 2 (FS2). The product level is stable, in
this case at PL2. The Servo Auto Test is initiated at set intervals. During
a Servo Auto Test the wire tension exceeds the limit in three
subsequent attempts.
FIGURE 2-3
Failure State example - product level is stable
2-6
854 ATG/XTG level gauge
Safety Manual
Part No.: 4417.808_Rev00
Implementation
CHAPTER 3 IMPLEMENTATION
3.1 General
This chapter provides the information that is relevant for correct
implementation of the safety-related function(s) of the 854 ATG/XTG
level gauge.
3.2 Assumptions and Constraints
The user must install, implement and use the 854 ATG/XTG level gauge
according to the conditions that are specified in this manual. The SIL
compliant overfill protection will operate as intended when:
the standard architecture is present,
the correct configuration is installed and commissioned.
Any servo-based level gauge of the type 854 ATG/XTG level gauge that
does not comply with these features cannot be used for this purpose.
3.3 New Installation or Upgrade
3.3.1 New Installation
In case you have purchased an 854 ATG/XTG level gauge that is
suitable for SIL compliant overfill protection, this function is included
by design. This means that the required architecture, hardware and
software is present in the device. Correct implementation of the function
is obtained by setting the required configuration during commissioning.
3.3.2 Upgrade
In case you own an 854 ATG/XTG level gauge, the SIL compliant
overfill protection can be included by upgrading the device. By
ordering the option for SIL compliant overfill protection you will receive
the required features. Implementation of the upgrade needs to be done
by a qualified Service Engineer.
Implementation of the upgrade implies:
for models that have an XPU-2 board installed, a firmware update
(EPROM) is required,
for models that have an XPU-1 board installed, this must be replaced
by an XPU-2 board and a firmware update (EPROM) is required,
commissioning is done according to the instructions in the
854 ATG/XTG level gauge Installation Manual.
Part No.: 4417.808_Rev00
854 ATG/XTG level gauge
Safety Manual
3-1
Implementation
3.4 Configuration
Hardware and software features contribute to the SIL compliant overfill
protection. TABLE 3-1 specifies the relevant boards the 854 ATG/XTG
level gauge must consist of and the relevant firmware. Further details
are described in the next paragraphs.
Board type
Revision
Firmware
Version
XPU-2
current
EPROM
H2.8
SPU-1
current
No density option
A2.3
With density option
C2.3
No density option
B2.3
With density option
D2.3
SPU-2
TABLE 3-1
current
Required boards and firmware
3.4.1 Hardware Configuration
This paragraph describes aspects of the design and integration of the
applicable hardware. The required hardware configuration of the 854
ATG/XTG level gauge is achieved by correct use of the specified
hardware elements (see TABLE 3-1). No further requirements apply to
the hardware configuration.
3-2
854 ATG/XTG level gauge
Safety Manual
Part No.: 4417.808_Rev00
Implementation
3.4.2 Software Configuration
This paragraph describes the steps to achieve the correct software
configuration of the 854 ATG/XTG level gauge. The are:
execution of the software settings (commissioning),
verification of the function (see chapter 3.5).
To guarantee correct functioning of the overfill protection the Servo
Auto Test configuration parameters must be set correctly.
TABLE 3-2 provides an overview of the applicable items and their
settings for configuration (N/A means: not aplicable).
Default 1
Min - Max values 1
Eng. unit 2
Prot. level 3
<E>
N/A
N/A
Servo Auto Test raise height
+000.0200
+000.0100 - +000.2500
see [LD]
[SI]
Servo Auto Test interval time
00060
00001 - 40320
minutes
[SY]
Servo Auto Test invalidates
display and level
<N>
N/A
N/A
[XI]
Servo Auto Test level movement
detector sample interval
60
10 - 200
seconds
[XT]
Servo Auto Test level movement
detector trip distance
+000.0030
+000.0010 - +000.3000
see [LD]
Item
Description
[SE]
Servo Auto Test enabled
[SH]
1. Values for heights and distances are given in meters.
2. LD is the standard item to set the Level Dimension:
(M = metres; F = feet; I = inches; P = fractions).
3. Protection levels are provided for all Items, depending
on the importance of an item.
TABLE 3-2
Software settings
Relevant configuration details per item are described below.
Item [SE].
In case compliant overfill protection is required the default value <E>
must be kept. In case this function is not required set the value to <D>.
Items [SH] and [SI].
The default settings provide for most common applications. The user
can adapt the values in accordance with application or process needs.
Item [SY].
With this item the visibility of Servo Auto Test details on a display and
host system is controlled. Preferably the default value <N> of this item is
kept. If the value is set to <Y> the host system can show that the gauge
is in test.
Part No.: 4417.808_Rev00
854 ATG/XTG level gauge
Safety Manual
3-3
Implementation
Items [XI] and [XT].
These items are related to the movement detector that samples the
level in the tank at regular intervals. They are also closely related to
each other. They are used to determine if the product level in a tank is
stable or moving.
With item [XI] the user determines the time between two consequetive
samples by the movement detector. Item [XT] represents the trip
distance. If the absolute difference between two samples exceeds the
trip distance it is assumed that the tank is being loaded or unloaded.
This movement detection is necessary to disable the Servo Auto Test
during loading and unloading of the tank. It is also used to determine
that the product movement stops and a Servo Auto Test can be initiated
again.
Detection takes place after a certain time lapse. In theory the minimum
time lapse is zero (0) seconds and the maximum time lapse is 2 x [XI].
Although the default values for items [XI] and [XT] are based on field data
and experience, they cannot be automatically used. As circumstances
of different tank systems can strongly vary, appropriate values have to
be determined for any specific system.
It is advised to follow the steps below in the given order to determine the
values for these items to avoid over or underrated responses.
1. Determine the maximum deviation of the measured product level in
the tank when the product level is stable (PLSTAB-), i.e. no loading or
unloading. Level deviations can occur due to weather conditions,
e.g. wind on a floating roof tank system.
2. Set the value of item [XT] in the engineering units of the gauge so that
it equals: PLSTAB- + 1 mm.
3. Determine the average product level increase per second during
loading of the tank in the engineering units of the gauge. This is
variable A.
4. Calculate item [XI] as follows: [XI] = [XT] / (1/2 A).
The greater the value for item [XI] the longer it will take before the Servo
Auto Test is executed after tank loading is finished. Preferably, this
period must be as short as possible to prevent tank overfill due to a
mechanical obstruction.
This effect occurs because tank loading and unloading does not start
and stop suddenly. If these would occur abruptly parts of the tank
system can get damaged (e.g. pipes). Therefore opening and closing of
valves and starting and stopping of pumps is done gradually.
3.5 Verification of the Safety Instrumented Function(s)
To verify the correct functioning of the overfill protection function carry
out the procedure of chapter 4.3 "Proof Testing".
3-4
854 ATG/XTG level gauge
Safety Manual
Part No.: 4417.808_Rev00
Maintenance Requirements
CHAPTER 4 MAINTENANCE REQUIREMENTS
4.1 Purpose
This chapter provides the information that is relevant for correct
maintenance of the safety-related function(s) of the 854 ATG/XTG level
gauge.
4.2 Diagnostic items
To determine correct functioning of the overfill protection the Servo
Auto Test a number of diagnostic items are available.
TABLE 4-1 provides an overview of the applicable items and their
corresponding value ranges (N/A means: not aplicable).
Item
Description
Default 1
Min - Max values 1
Eng. unit 2
Prot. level 3
[PE]
Level at which the Servo Auto
Test last failed
+999.9999
+999.9999 - +999.9999
see [LD]
[PL]
Level at which the Servo Auto
Test was last executed
+999.9999
+999.9999 - +999.9999
see [LD]
[PX]
Minimum level at which the
Servo Auto Test was performed
+999.9999
+999.9999 - +999.9999
see [LD]
[PY]
Maximum level at which the
Servo Auto Test was performed
+999.9999
+999.9999 - +999.9999
see [LD]
[PZ]
Highest number of Servo Auto
Test retries
0-9
N/A
[SN]
Number of executed Servo Auto
Tests
00000
00000 - 99999
N/A
[SQ]
Servo Auto Test status
N/A
N/A
N/A
[SZ]
Time elapsed since last Servo
Auto Test
00000
00000 - 99999
minutes
1. Values for heights and distances are given in meters.
2. LD is the standard item to set the Level Dimension:
(M = metres; F = feet; I = inches; P = fractions).
3. Protection levels are provided for all Items, depending
on the importance of an item.
TABLE 4-1
Software settings
Relevant details about these diagnostic items are described in chapter
4.3 "Proof Testing".
Part No.: 4417.808_Rev00
854 ATG/XTG level gauge
Safety Manual
4-1
Maintenance Requirements
4.3 Proof Testing
To make sure that the overfill protection remains SIL compliant a proof
test has to be performed once per 5 years.
Points of attention:
It is strongly recommended not to open the 854 ATG/XTG level
gauge for proof testing unless test results or other findings demand
internal maintenance and/or repair.
For the purpose of this procedure it is assumed that the Service
Engineer performs the proof test:
preferaby from the control system, using available diagnostic
tools,
as an alternative at the gauge, using a Portable Enraf Terminal
(PET).
It is advised to compare the test results with historic data, if available.
In this way trends in behavior can be determined.
Follow the steps below in the sequence given:
1. Determine that the examined gauges are certified for SIL compliant
overfill protection.
If not OK - contact plant management for further action.
If OK - continue with the next step.
2. Determine the actual status and values of the relevant configuration
items for each gauge (refer to TABLE 3-2). Record this data for later
reference.
Make sure that the values of the configuration items comply with the
settings as conducted during commission and/or approved changes.
Pay special attention to item [SE] Servo Auto Test enabled; this
should have the default value [E], enabled.
If not OK - contact plant management for further action.
If OK - continue with the next step.
3. Perform a predictive diagnosis for the relevant diagnostic items
(refer to TABLE 4-1). Do this for the gauge(s) involved. Record this
data for later reference.
Note: in this way the behavior of the gauge with respect to the
overfill protection since the previous diagnosis is shown.
4. Analyze the results of step 3. above:
- look for unusual and/or exceptional behavior,
- compare the data with historical data, and look for trends,
- prepare a report for plant management; discuss any highlights,
- initiate preventive and/or corrective maintenance if necessary.
5. Reset the relevant diagnostic items to their default values.
This applies to the items that have a Protection level 1 (see TABLE
4-1).
6. Finally, execute the required certification renewal procedure.
4-2
854 ATG/XTG level gauge
Safety Manual
Part No.: 4417.808_Rev00
Honeywell Enraf
Delftechpark 39
2628 XJ Delft
The Netherlands
Tel: +31 (0)15-2701 100
Email: [email protected]
www.honeywellenraf.com
4417808 - Revision 0
February 2011
2011 Honeywell International Inc.
