The devil is in the detail

Electrical temperature measuring points viewed from the SIL perspective

The devil is in the detail

Any plant in the chemical industry is bursting with safety-relevant technology. Thousands of thermometers and transmitters are used for electrical temperature monitoring alone. To embed this vast quantity in a functioning safety concept requires an immense effort. Even more so, since different standards must be relied upon. The application of SIL (safety integrity level) regulations to temperature measuring points, for example, shows that the devil is in the detail.

While plant designers, from a measurement technology perspective, conceptualise the “big picture”, suppliers have the task of providing exactly matched individual components. Manufacturers of temperature measurement equipment thus operate in a field of conflict between mechanical and metrological requirements, which has wid-ened over time. Electrical thermometers must permanently withstand high pressures, temperatures and flows, but must also work perfectly in case of severe vibration or aggressive media. At the same time, operators require high accuracy with short response times, coupled with stable signal processing as well as high dielectric strength, insulation and EMC resistance.

The technical implementation is by no means simple due to the diversity of international directives and standards. For example, the SIL-relevant IEC/EN 61508 (for manufacturers and suppliers of equipment) and the related IEC/EN 61511 (for the process industry) provide concrete specifications. However, they only apply to electronic systems, in other words to the transmitter in a temperature measurement set-up. The sensor, that is the thermometer itself, is hence not covered by SIL regulations.

Yet, since a thermometer without a transmitter, or vice versa, makes no sense, SIL measuring points must be assessed as a whole. So which sensor fits best? Design-specific regulations for temperature sensors provide ample scope for interpretation. Not all chemical companies have a sufficiently large specialist department to clarify in detail all the questions that may arise faced with such a multitude of standards. It is a good idea for them to cooperate with a qualified manufacturer who implements the necessary management systems. IEC/EN 61508 demands this anyway for real SIL components.

This form of cooperation is actually an economical solu-tion, and this becomes clear when the planning effort for a safety-relevant temperature measurement point is examined in more detail. At the heart of this arrangement is the temperature transmitter in the connection head. In the example described here, this is a Wika T32.xS. This transmitter has been on the market for eight years and, to date, is the only instrument of its kind whose hardware and firmware were not only developed in accordance with the SIL standard but also certified following a full assessment by TÜV Rheinland. The transmitter is suitable for use in SIL applications up to level 3. Transmitters or other intelligent devices with the “proven in use” classification are not capable of higher than SIL 2.

Safety integrity in accordance with IEC/EN 61508 always applies, as mentioned above, to an entire system. The level which the operator is seeking to achieve is thus the sum of the SIL levels of all electronic components involved, i. e. the data transmission cable to the control level and the processing functions there in addition to the transmitter.

The temperature sensor is connected to the transmitter within the connection head and is thus a part of the safety instrumented function (SIF). However, since the sensor has no built-in electronics and cannot assess itself, it cannot obtain SIL qualification. So sensors with SIL certification simply do not exist, even if this term does crop up every now and then.

Nevertheless, the suitability of a sensor from the SIL perspective must be taken into account. Two types are generally used worldwide for electrical temperature measurements in the process industry: resistance thermometers with Pt100 sensors in Europe and thermocouples throughout the rest of the world. There are no universally applicable guidelines to help operators decide which sensor harmonises best with a particular SIL application. Global producers often have a different understanding of the underlying criteria depending on the region of origin.

To be on the safe side, users should basically ask detailed questions. What design lies behind the Pt100 being offered? What electrical connection does the sensor have? Which materials are used for the mineral-insulated sheathed cable of the measuring insert? What is the quality of the platinum and which alloy are the copper wires made from? The effort involved is immense. An improved guideline is expected soon from Namur, the user association of automation technology in process industries, which has been addressing the issue extensively and is further developing its recommendation NE24 (Requirements governing measuring inserts for temperature sensors utilised in intrinsically safe circuits).

In addition to the purely technical stipulations, users need values for the design-related failure probability of a temperature sensor. Although statistics can always be found in the relevant reference works, they tend to be rather general. The analogy of a car illustrates the kind of information they reveal: with proper care, a car can run for several hundred thousands of kilometres. However, everyone knows that a racing driver could wear out the same car within hours. When it comes to measuring point safety, therefore, it is better to focus on the actual application, the process conditions and their extremes.

The stability and accuracy of temperature measurements depend to a great extent on the prevention of negative influences. This is where the thermometer’s protective fitting comes in – in this example of a SIL measuring point, it consists of a thermowell, neck tube and thermometer connection head. The thermowell fulfils a dual purpose: it protects the sensor and, at the same time, enables calibration with the process sealed. This simplifies recurring proof tests, which according to the regulations are mandatory for SIL measuring points.

Thermowells for safety-relevant measuring points are not standardised products. Their durability, for instance, is designed at Wika using proprietary software and taking all process parameters into account. This means more than just thermal effects and aggressive substances. The thermowell must endure vibration loads without failure and simultaneously prevent this vibration from adversely affecting the measuring insert and thus distorting the measured value. A transmitter communicates every single change in the measured value to the control system, yet it cannot see the cause – a genuine temperature change or a sensor failure after all.

Hall 11, Booth C48

www.cpp-net.com search: cpp0116wika

Andreas Cohrs

Business Development Manager Sales Germany,Wika Alexander Wiegand

Comment

Good design is vital

Temperature safety functions present plant operators with several challenges from the perspective of functional safety management. This applies from the specification phase onwards, when process engineeringexperts must define the function’s trip setpoint and maximum allowable response time (MART). The closer the trip setpoint is to the critical temperature in the process and the shorter the selected maximum allowable response time to restore the plant to a safe condition, the more complicated this gets. The design of the temperature measuring point is determined by the specified safety-relevant parameters and the prevailing process conditions, though it also depends on the installation location and the choice of apparatus.

After installing the measuring point, safety control and actuator, the safety function must be validated, meaning a proof of its correct functionality must be provided. This is relatively easy to do for the temperature at the trip setpoint, but testing the sensor’s response time in the fitted state can turn out to be a very difficult undertaking.

When the plant is operated subsequently, each safety device must be regularly subjected to repeated proof testing. Investigations within Namur have shown that operators adopt very different proof test approaches. Significant variations in the inspection depth are possible depending on the methodology which is selected. The established formulae for SIL calculations primarily relate to 100 % proof test coverage. Furthermore, plant operators tend to take a critical view of annual repeat testing. As a result, Namur is currently revising its NE106 recommendation.

Udo Menck is European SIS Implementation Leader at Dow Chemical, Stade, and a member of various committees on functional safety (DKE, VDI / VDE, Namur)