EMERSON Tartarini BM5/BM5A Slam Shut Valve User Manual

EMERSON Tartarini BM5/BM5A Slam Shut Valve

Purpose
This safety manual provides information necessary to design, install, verify and maintain a Safety Instrumented Function (SIF) utilizing the Type BM5/BM5A Slam Shut Valve.

Introduction

This manual provides necessary requirements for meeting the IEC 61508 or IEC 61511 functional safety standards.

Terms and Abbreviations

• Safety: Freedom from unacceptable risk of harm.
• Functional Safety: The ability of a system to carry out the actions necessary to achieve or maintain a defined safe state for the equipment/machinery/plant/apparatus under control of the system.
• Basic Safety: The equipment must be designed and manufactured such that it protects against risk of injury to persons by electrical shock and other hazards and against resulting fire and explosion. The protection must be effective under all conditions of the nominal operation and under single fault condition.
• Safety Assessment: The investigation to arrive at a judgment, based on the facts, of the safety achieved by safety-related systems.
• Fail-Safe State: State where valve actuator is de-energized and spring is extended.
• Fail-Safe: Failure that causes the valve to go to the defined fail-safe state without a demand from the process.
• Fail Dangerous: Failure that does not respond to a demand from the process (i.e. being unable to go to the defined fail-safe state).
• Fail Dangerous Undetected: Failure that is dangerous and that is not being diagnosed by automatic stroke testing.
• Fail Dangerous Detected: Failure that is dangerous but is detected by automatic stroke testing.
• Fail Annunciation Undetected: Failure that does not cause a false trip or prevent the safety function but does cause loss of an automatic diagnostic and is not detected by another diagnostic.
• Fail Annunciation Detected: Failure that does not cause a false trip or prevent the safety function but does cause loss of an automatic diagnostic or false diagnostic indication.
• Fail No Effect: Failure of a component that is part of the safety function but that has no effect on the safety function.
• Low Demand Mode: Mode where the frequency of demands for operation made on a safety-related system is no greater than twice the proof test frequency.

Acronyms

• FMEDA: Failure Modes, Effects and Diagnostic Analysis
• HFT: Hardware Fault Tolerance
• MOC: Management of Change. These are specific procedures often done when performing any work activities in compliance with government regulatory authorities.
• PFDAVG: Average Probability of Failure on Demand
• SFF: Safe Failure Fraction, the fraction of the overall failure rate of a device that results in either a safe fault or a diagnosed unsafe fault.
• SIF: Safety Instrumented Function, a set of equipment intended to reduce the risk due to a specific hazard (a safety loop).
• SIL: Safety Integrity Level, discrete level (one out of a possible four) for specifying the safety integrity requirements of the safety functions to be allocated to the E/E/PE safety-related systems
• where Safety Integrity Level 4 has the highest level of safety integrity and Safety Integrity Level 1 has the lowest.
• SIS: Safety Instrumented System – Implementation of one or more Safety Instrumented Functions. A SIS is composed of any combination of sensor(s), logic solver(s), and final element(s).

Related Literature

Hardware Documents:

• Type BM5 Slam Shut Valve Bulletin: D104043X012
• Type BM5 Slam Shut Valve Instruction Manual: D103656X012
• Type BM5A Slam Shut Valve Bulletin: D104576X012
• Type BM5A Slam Shut Valve Instruction Manual: D103580X012

Guidelines/References:

• Safety Integrity Level Selection –Systematic Methods Including Layer of Protection Analysis, ISBN 1-55617-777-1, ISA
• Safety Instrumented Systems Verification, PracticalProbabilistic Calculations, ISBN 1-55617-909-9, ISA

Reference Standards

Functional Safety

• IEC 61508: 2010 Functional safety of electrical/electronic/programmable electronic safety-related systems
• ANSI/ISA 84.00.01-2004 (IEC 61511 Mod.) Functional Safety – Safety Instrumented Systems for the Process Industry Sector

Device Description

The purpose of the Type BM5/BM5A Slam Shut Device (see Figure 1) is to totally and rapidly cut the flow of gas when the inlet and/or outlet pressure in the system either exceeds or drops below set points. The Type BM5/BM5A is axial flow design and possible to fit in all positions. Limit switch, Solenoid is an option for device status transmitter and remote control.

Designing a SIF Using Type BM5/BM5A Slam Shut Valve

Safety Function
When the inlet and/or outlet pressure in the system either exceeds or drops below set points, the actuator and valve shall move to its fail-safe position. The valve plug will move to close off the flow path through the valve body. The Type BM5/BM5A Slam Shut Valve is intended to be part of final element subsystem as defined per IEC 61508 and the achieved SIL level of the designed function must be verified by the designer.

Environmental limits
The designer of a SIF must check that the product is rated for use within the expected environmental limits. Refer to the Type BM5/BM5A Slam Shut Valve Product Bulletin for environmental limits.

Application limits
The materials of construction of Type BM5/BM5A Slam Shut Valve are specified in the product bulletins. A range of materials are available for various applications. The serial card will indicate what the materials of construction are for a given valve. It is especially important that the designer check for material compatibility considering on-site chemical contaminants and environmental conditions. If the Type BM5/BM5A Slam Shut Valve is used outside of the application limits or with incompatible materials, the reliability data provided becomes invalid.

Design Verification
The achieved SIL of an entire SIF design must be verified by the designer via a calculation of PFDAVG considering architecture, proof test interval, proof test effectiveness, any automatic diagnostics, average repair time and the specific failure rates of all products included in the SIF. Each subsystem must be checked to assure compliance with minimum  HFT requirements. When using a Type BM5/BM5A Slam Shut Valve in a redundant configuration, a common cause factor of at least 5% should be included in the Safety Integrity calculations. The failure rate data listed in the SIL Certificate is only valid for the useful lifetime of a Type BM5/BM5A Slam Shut Valve. The failure rates will increase after this time period. Reliability calculations based on the data listed in the SIL Certificate for mission times beyond the useful lifetime may yield results that are too optimistic, i.e. the calculated Safety Integrity Level will not be achieved.

SIL Capability

Systematic Integrity
The product has met the manufacturer design process requirements of SIL 3. These are intended to achieve sufficient integrity against systematic errors of design by the manufacturer. A SIF designed with this product must not be used at a SIL level higher than stated without “prior use” justification by the end user or diverse technology redundancy in the design.

Random Integrity
Type BM5/BM5A Slam Shut Valve is classified as Type A element according to IEC 61508, having a hardware fault tolerance of 0. The complete final element subsystem will need to be evaluated to determine the Safe Failure Fraction of the subsystem. If the SFF for the entire final element subsystem is between 60% and 90%, a design can meet SIL 2 @ HFT=0.

Safety Parameters
For detailed failure rate information refer to the Failure Modes, Effects and Diagnostic Analysis Report for the Type BM5/BM5A Slam Shut Valve.

General Requirements
The system’s response time shall be less than process safety time. The final control element subsystem needs to be sized properly to assure that the response time is less than the required process safety time. The Type BM5/BM5A Slam Shut Valve will move to its safe state in less than the required SIF’s safety time under the specified conditions. All SIS components of Type BM5/BM5A Slam Shut Valve must be operational before process start-up. The user shall verify that the Type BM5/BM5A Slam Shut Valve is suitable for use in safety applications. Personnel performing maintenance and testing on the Type BM5/BM5A Slam Shut Valve shall be competent to do so. Results from the proof tests shall be recorded and reviewed periodically. The useful life of the Type BM5/BM5A Slam Shut Valve is discussed in the Failure Modes, Effects and Diagnostic Analysis Report.

Installation and Commissioning

Installation
The Type BM5/BM5A Slam Shut Valve must be installed per standard practices outlined in the appropriate Instruction Manual. The environment must be checked to verify that environmental conditions do not exceed the ratings. The Type BM5/BM5A Slam Shut Valve must be accessible for physical inspection.

Physical Location and Placement
The Type BM5/BM5A Slam Shut Valve shall be accessible with sufficient room for the actuator, pneumatic connections and any other components of the final control element. Provisions shall be made to allow for manual proof testing. Pneumatic piping to the actuator shall be kept as short and straight as possible to minimize the airflow restrictions and potential clogging. Long or kinked pneumatic tubes may also increase the valve closure time.

The Type BM5/BM5A Slam Shut Valve shall be mounted in a low vibration environment. If excessive vibration can be expected special precautions shall be taken to ensure the integrity of pneumatic connectors or the vibration should be reduced using appropriate damping mounts.

Operation and Maintenance

Suggested Proof Test
The objective of proof testing is to detect failures within a Type BM5/BM5A Slam Shut Valve that are not detected by any automatic diagnostics of the system. Of main concern
are undetected failures that prevent the Safety Instrumented Function from performing its intended function. The frequency of proof testing, or the proof test interval, is to be determined in reliability calculations for the Safety Instrumented Functions for which a Type BM5/BM5A Slam Shut Valve is applied. The proof tests must be performed more frequently than or as frequently as specified in the calculation in order to maintain the required Safety Integrity of the Safety Instrumented Function.

The proof test shown in Table 1 is recommended. The results of the proof test should be recorded and any failures that are detected and that compromise functional safety should be reported to Emerson. The suggested proof test consists of a full stroke of the Type BM5/BM5A Slam Shut Valve. The person(s) performing the proof test of a Type BM5/BM5A Slam Shut Valve should be trained in SIS operations, including bypass procedures, valve maintenance and company Management of Change procedures. No special tools are required.

Type BM9

trip.
2| Change the sensor(s) pressure to simulate a trip and observe that the valve stroked to the Fail-Safe state and confirm that the Safe State was achieved and within the correct time. Inspect for damage or leakage of the valve.
3| Determine the codes and standards applicable to the valve installation and confirm that the valve internal leakage does not exceed the leakage specification.
4| Restore the process signal to the sensor and reset the valve. Check the valve for any leaks, visible damage or contamination and confirm that the normal operating state was achieved.
5| Remove the bypass and restore normal operation.

Repair and Replacement
Repair procedures in the appropriate valve instruction manual must be followed.

Manufacturer Notification
Any failures that are detected and that compromise functional safety should be reported to Emerson. Please contact your local Sales Office.

Note
Neither Emerson nor any of their affiliated entities shall not assume responsibility for the selection, use, or maintenance of any product. Responsibility for the selection, use, and maintenance of any product remains with the purchaser and end user.

Contacts

• Webadmin.Regulators@emerson.com
• Tartarini-NaturalGas.com
• Facebook: Facebook.com/EmersonAutomationSolutions
• Linkedin: LinkedIn.com/company/emerson-automation-solutions
• Twitter: Twitter.com/emr_automation

Emerson Automation Solutions

Americas

• McKinney, Texas 75070 USA
• T +1 800 558 5853 /+1 972 548 3574

Europe

• Bologna 40013, Italy
• T +39 051 419 0611

Asia Pacific

• Singapore 128461, Singapore
• T +65 6777 8211

Middle East and Africa

• Dubai, United Arab Emirates
• T +971 4 811 8100

Emerson Process Management s.r.l.
Emerson Automation Solutions – Stabilimento di/Site of: Castel Maggiore – Bologna Sede Legale/Legal Entity: Piazza Meda 5, 20121 Milano, Italy Sede Amministrativa/Administrative Headquarters: OMT Tartarini, Via Clodoveo Bonazzi 43, 40013 Castel Maggiore (Bologna), Italy C.F. – P.I. e R.I. di MI 13186130152 – REA di MI/n.1622916 Direz. e Coord. (art. 2497 bis CC): EMERSON ELECTRIC CO. St. Louis (USA) Socio Unico.

D103500X012 © 2014, 2022 Emerson Process Management Regulator Technologies, Inc. All rights reserved. 07/22. The Emerson logo is a trademark and service mark of Emerson Electric Co. All other marks are the property of their prospective owners. Tartarini™ is a mark owned by one of the companies in the Emerson Automation Solutions business unit of Emerson Electric Co. The contents of this publication are presented for informational purposes only, and while every effort has been made to ensure their accuracy, they are not to be construed as warranties or guarantees, express or implied, regarding the products or services described herein or their use or applicability. All sales are governed by our terms and conditions, which are available upon request. We reserve the right to modify or improve the designs or specifications of such products at any time without notice. Emerson Process Management Regulator Technologies, Inc does not assume responsibility for the selection, use or maintenance of any product. Responsibility for proper selection, use and maintenance of any Emerson Process Management Regulator Technologies, Inc. product remains solely with the purchaser.

Read User Manual Online (PDF format)

Read User Manual Online (PDF format)  >>

Download This Manual (PDF format)

Download this manual  >>