ABB 266D Series Short Form Instruction Manual page 20

COMMISSIONING
Overall System Functionality
The activities to validate the required safety functionality of the system together with the pressure transmitter according to the Safety
Requirement Specification is the Pre-Startup Acceptance test.
FAULTS OUTSIDE THE FUNCTIONAL SAFETY
The redundant algorithms and the electronics are designed to detect all the internal hardware faults therefore the transmitter diagno-
stic is not able to detect faults related to the process and to the installation configuration. In the following table the known weaknesses
resulting from the transducer FMEA (Failure Mode and Effect Analysis) are listed.
Assembled material at the pipes of the transmitter, blockage of pipe.
Application outside specified temperature range.
Excess of temperature
Assembled gas at the transmitter, if the transmitter is mounted above the process line
Overload pressure, high peak pressure pulses in process lines
Penetration of hydrogen, diaphragm crack in applications with hydrogen process medium.
Thin walled diaphragm, leaky diaphragm in applications with abrasive medium.
Thin walled diaphragm, leaky diaphragm in applications with corrosive medium.
Higher diaphragm stiffness, crack in application with contamination of metal ions
Mechanical damage through cleaning, damage of the coating, corrosion.
Other considerations
The alarm levels of the transmitter (down-scale or up-scale) can be selected by the user. As default all the 266 devices are configu-
red with up-scale alarm. For some faults (e.g. crystal breakdown), the output will latch at 3.6 mA even if the up scale alarm level is
selected.
ARCHITECTURE DESCRIPTION AND PRINCIPLE OF OPERATION
The instrument consists of two main functional units:
- Primary unit
- Secondary unit
The pressure transducer unit includes the process interface, the sensor and the front-end electronics; the Secondary Unit includes the
electronics, the terminal block and the housing. The two units are mechanically coupled by a threaded joint.
PRINCIPLE OF OPERATION
The principle of operation is as follows. In the primary unit the process fluid ( liquid, gas or vapour ) exerts pressure on to the sensor
via flexible, corrosion-resistant isolating diaphragms and capillary tubing containing the fill fluid.
As the sensor detects the pressure changes, it simultaneously produces variations of the primary physical value depending on the
sensor technology (capacitive, inductive or piezoresistive). The signal is then converted in the front-end electronics in a digital form
and the raw values are computed by a microcontroller to a precise primary output linearization, compensating for the combined effects
of sensor non linearity, of static pressure and temperature changes on the basis of the "mapped" parameters calculate in the manufac-
turing process and stored in the memory of the Front End electronics. Calculations follow independent flows and they are compared in
the microcontroller in order to validate the output pressure signal. If a difference between the two measurements is detected the ana-
log output is driven to a safety condition. The measured values and the sensor parameters are transferred via a standard serial digital
communication to the secondary unit where the communication board is fitted. The output data value is converted into a pulse-width
signal that is filtered and that activates the 4-20 mA transmitter. The bi-directional, digital communication using the standard "HART"
protocol is implemented as part of this unit. Internal diagnostics algorithms are implemented to check correctness and validity of all
processing variables and the correct working of memories. The output stage is also checked by reading back the analog output signal
and by reading the power supply voltage. The feedback loop is obtained by an additional A/D converter put at the end of the output
stage, which translates the 4-20 mA signal into a digital form suitable to be compared by the microcontroller.
COMMISSIONING AND CONFIGURATION ISSUES
The transmitter is considered in safety condition (normal operating mode) when the write protect switch placed outside the transmitter
housing below the metallic nameplate is in Write Protect. In that condition all kind of configurations of the device are disabled.
Operating mode enabling and disabling
Operating mode can be enabled/disabled depending on the switch position. It is also possible to put the device in write protect condi-
tion by a dedicated HART command. In any case the switch position has the priority on the software command.
WARNING - After any configuration operation, the transmitter must be put in operating mode.
PROOF TESTS
Safe undetected faults could occur during the operation of the transmitters. These failures do not affect the transmitter operations. To
maintain the claimed Safety Integrity Level (SIL 2) a proof test procedure is requested every 10 years.
The proof tests consists in the following operations:
1. Switch off the device.
2. Assure that the Write Protect Mode switch is in Write Protect condition.
3. Power-on the transmitter: the transmitter performs automatically a self-test that consists in the operations below:
ROM test
RAM test
Test of the analog output stage and of the feedback A/D converter
Test of the power supply voltage
Non volatile memory test
4. Apply pressure up to 50% of the caibrated range and check the output value. It shall be within the stated safety accuracy (2% of
sensor range).
In case the tests would fail the transmitter will drive the output to the alarm values. In this case a correction action consists in the re-
calibration of the D/A converter. In case the normal functionality will be not re-established, the transmitter shall be considered failed
and not possible to use.
20 SOI/266-XC | 2600T Series Pressure transmitters 266 models