BS EN 50402:2017 download.Electrical apparatus for the detection and measurement of combustible or toxic gases or vapours or of oxygen Requirements on the functional safety of gas detection systems.
1 Scope
BS EN 50402 is applicable to detection and measurement apparatus and systems for flammable or toxic gases or vapours or oxygen. It covers apparatus intended to measure reliably, gas concentration and to provide an output signal (alarm and/or measurement signal), the purpose of which is to give a warning of a potential hazard.
BS EN 50402 is a product standard which is based on EN 61508 (all parts) and for gas detection systems covers both low and high demand mode at SIL capabilities of 1, 2 or 3 only. Gas detection apparatus and gas detection systems are developed as generic products. BS EN 50402 covers part of the phase 10 realization” of the overall safety lifecycle defined in EN 61508-1:2010. Figure 2. Configuration and integration into specific applications is not covered by this European Standard.
In the event of conflict between the requirements of BS EN 50402 and those of EN 61508, EN 50402 will take precedence.
NOTE 1 Applications requiring a SIL capabihty of 4 for a gas detection system are not practicable.
BS EN 50402 is dedicated mainly to fixed apparatus and systems. However. It can also be applied to transportable gas detectors which are intended to be used as temporary replacements for fixed apparatus.
BS EN 50402 supplements the requirements of the European Standards for electrical apparatus for the detection and measurement of flammable gases, vapours (e.g. EN 60079-29-1 or EN 60079-29-4), toxic gases (e.g. EN 45544) or oxygen (e.g. EN 50104).
NOTE 2 BS EN 50402 are called in the text “metrological standards.
The examples above show the state of the standardization for industrial applications at the time of publishing BS EN 50402. There may be other metrological standards covering other application fields, for which BS EN 50402 is also applicable.
EN 50271 specifies minimum requirements for apparatus using software and/or digital components. It also
defines additional optional requirements for compliance with SIL 1 in low demand mode operation. EN 50402
includes all requirements of EN 50271.
EN 50402 is also dedicated to apparatus and gas detection systems and/or components and should be used instead of EN 50271 in the following cases:
— at SIL 1 when the system contains components not covered by EN 50271:
In example 7 in Figure 2g the gas detector is a remote sensor connected to a gas detection control unit
The remote sensor and gas detection control unit including the switching output are in the scope of the
relevant metrological standard plus EN 50402.
The actuator driven by the switching output of the gas detection system is in the scope of EN 61508 (all parts).
4.2 Determination of safety function
In Clause 5, the modules of the gas detection system are defined according to their function and for each SILcapability the requirements are specified.
The SIL-capability of a module is determined by the measures and techniques for avoidance and control of faults In both, hardware and software. The SIL-capability number is a property of an element, a module, a combination of modules or of one or several safety function(s) of a gas detection system.
It is also a requirement of BS EN 50402 to determine the hardware failure rates for each safety function after dividing the gas detection system into physical components which may differ from the functional modules.
Users should be able to determine the performance of an overall safety system that incorporates a gas detection system in terms of safety integrity level (SIL) required according to EN 61508 (all parts). This is possible if the SIL-capability and associated hardware failure rate data are known for safety function of the gas detection system and the equivalent data are known for the other equipment (periphery) required for functional safety (see Clause 9).
The hardware SIL-capability and hardware failure rate of a safety function of a gas detection system may be derived from the SIL-capability of the functional modules, and hardware failure rates of the components (see Clause 7 and Annex C).
The software of all modules which are part of the safety function shall be developed in a process compliant with the SIL capability to be achieved for the safety function. If redundant hardware is used to achieve a higher SIL capability the software shall comply with this higher SIL capability (see Figure 6), or. the software of the redundant chains shall be verified to be diverse (see EN 61 508-7:2010, C.3.5).
If a gas detection system has different safety functions with different SIL capability there are two options:
a) the entire software has to comply to the higher SIL capability, or
b) it has to be verified that the software with the lower SIL capability will not interfere with the safety function of the higher SIL capability.
5.6.6 Reduced mode of operation
Characterization:
The reduced mode of operation permits the gas detection system to continue operating in measuring mode for a specified period of time when the gas detection system either does not comply with the original system performance requirements, or it has lost a level of redundancy.
If reduced mode of operation is implemented it is required to specify at least two tolerance bands for the parameters relevant for the reduced mode:
— If the narrower tolerance band(s) is exceeded then a maintenance request shall be indicated but the gas detection system remains in measuring mode.
— If the broader tolerance band is exceeded the system shall enter a special state.
If loss of redundancy is detected and the safety function is still available then the system is permitted to continue in its reduced operation mode instead of entering a special state.
EXAMPLE 1 For automatic calibration (without adjustment) the narrower tolerance band may be ± 5 % full scale and the broader tolerance band may be ± 10 % full scale.
EXAMPLE 2 The system Is specified to operate in a temperature range between —20 C and +55 C. If the temperature of + 55 °C is exceeded the system is still In measunng mode but specified tolerances for accuracy may be exceeded. If the temperature exceed5 the higher level (e.g. • 70 °C) specified by the manufacturer the system will enter a special state.
EXAMPLE 3 In a redundant system the internal diagnostic may recognize a discrepancy between both channels of a safety function or between hardware components. If neither subsystem recognizes an internal fault both channels will continue to operate but the reduced mode of operation will be entered.
Requirements:
All SIL-capabilities: The maximum period of reduced mode of operation shall be clearly specified In the safety manual. If the specified period of reduced mode of operation is exceeded then the system shall switch automatically to special state.
The tolerance bands shall be derived from the requirements of the relevant metrological standard(s) where applicable.
7 Combining Functional Modules to Safety Functions
7.1 SIL-capability
The SIL—capability for a module is determined by comparing the design with the requirements for the modules given in Clause 5. After determination of SIL-capability for each module the combination of modules within the entire gas detection system shall be determined.
The determination of SIL-capability for the gas detection system shall be carried out for each safety function separately. For a complex system the treatment of different safety functions may be carried out consecutively, which may result in different SIL-capabilities for the same gas detection system.
For one specific safety function only those functional modules have to be considered out of all existing functional modules which have an influence on this safety function. If for example three different output functions (modules) exist, only one of them may be relevant for a specific safety function (see a) below).
The following items explain the determination of SIL-capability by assessment of different modules as part of the safety function:
a) If switching operations for entering the safe state shall be actuated by relays in the module switching output’ (see 5.7.2) only, then the modules ‘output system communication’ (see 5.7.3) and output to periphery’ (see 5.7.4) are not considered part of the safety function. The module ‘output to periphery may belong to a lower SIL-capability in such an application and transmit data to a storage.
b) If additionally to a) switching operations are also carried out in another subsystem of the gas detection system, the module ‘output system communication’ shall also be included. Both considered safety functions shall comply with the SIL-capability required for the application
C) If switching operations for entering the safe state shall be actuated by external means in the periphery,
e.g. PLC, only, the module output to periphery’ is part of the considered safety function. In this case the gas detection system is only able to provide defined signals (measured values or alarm signals) related to a SIL-capability by the module ‘output to periphery’. From this interface onwards the user (or supplier of the total system) is responsible to achieve the required performance for signal transmission, assessment and actuating the switching operations.
The requirements of EN 61508-2 for SFF (Safe Failure Fraction) are achieved for each safety function by compliance with Clause 5 for each functional module. The SFF calculation for the complete safety function is not required.