Temperature is the most measured value in process engineering. It stands to reason that measuring temperature helps to detect hazardous conditions in plants so that corrective measures can be taken at an early stage. Therefore, the temperature measuring point itself must be designed in accordance with functional safety standards for process technology.
What Do the Standards Say for Thermometers?
Safety Integrity Level (SIL) is a relative level of risk reduction provided by a safety function or to specify a target level of risk reduction. Simply put: SIL is a measurement of performance required for a Safety Instrumented Function. There are four SILs, with SIL4 being the most dependable and SIL1 being the least.
The International Electrotechnical Commission (IEC) 615081 standard mandates requirements for SIL (Safety Integrity Level) devices, as being able to:
- Eliminate device faults, as far as possible
- Detect unavoidable faults, if possible
- Report the detected faults
According to the EN/IEC 61508-4 standard, an SIL classification is only possible when the device is in a position to carry out an evaluation. The standard also shows that the sensor itself (RTD or TC) cannot be evaluated because the sensor lies outside the limits of the defined system.
A temperature sensor without a transmitter is not able to evaluate its own performance. In effect, a thermometer is only a piece of wire: an RTD is a long, thin platinum wire while a TC is two different wires. So, how can a piece of wire evaluate its own performance? SIL-classified temperature sensors do not exist, but an electronic temperature transmitter without a connected sensor has no useful function. Instead, the evaluation of a temperature measuring point can only be made by a combination of a sensor and electronics.
Possible Faults in Temperature Sensors
During the safety-relevant evaluation, four different fault types can be determined:
- Safe faults (s = safe) have no direct influence on the result of measurement.
- Dangerous faults (d = dangerous) distort the result or lead to an immediate failure.
- Detectable faults (d = detectable) can be detected by means of the connected evaluation electronics.
- Undetectable faults (u = undetectable) cannot be detected at all or only with the help of external auxiliary tools.
An overload may lead to a break in the input conduits or to the failure of a sensor element, which can be easily detected by the connected temperature transmitter. A sensor break is therefore a dangerous but detectable fault for which the abbreviation ?dd is used.
The progressive changes in the sensor element are often caused by mechanical or thermal overload, but also may be due to chemical attack. A temperature transmitter cannot distinguish whether a change in the measured value has been caused by a change in temperature or by a fault. For this reason, drift is a dangerous and undetectable fault (?du) which has a special relevance for the SIL evaluation.
A short circuit in the sensor, connecting cable, or the plug of a resistance thermometer can be detected relatively easily by a transmitter. This is a dangerous but detectable fault, which is denoted by ?dd.
Connection terminals, connecting cables, and plugs are the most frequent sources of faults on resistance thermometers. Depending on the method of connection, these can directly influence the measurement result. If the contact resistance in a two-wire circuit increases, the indicated value increases as well. This is the reason why this fault is stated as ?du. If only one conduit resistance or contact resistance in a three-wire circuit changes, an error to a higher or lower value is possible. This is also given as ?du.
In a four-wire circuit, all influences of the connecting conduits, terminals, and connectors are compensated. All resistance changes are detected as non-dangerous but undetectable faults, ?su. In a safety-relevant evaluation, this method of connection is rated the highest.
Specific Fault Possibilities on Thermocouples
A short circuit in the connecting cable or in the plug cannot be distinguished from the condition “plant is off, internal and external temperatures are the same.” For this reason, this is an especially dangerous and non-detectable fault: ?du.
In a thermocouple, all the influences of connecting cables, connection terminals, and connectors are compensated. All resistance changes are detected as non-dangerous but undetectable faults, or ?su.
Failure Probability in Thermometers
SIL thermometers are favored for use in harsh conditions. High temperatures, aggressive, toxic or flammable media, and vibrations make the conditions more severe. The statistical failure probability is indicated in the unit FIT. One FIT denotes one expected fault during a sample of one billion hours of operation of all instruments of one specific version in use in the field. Vibrations often occur in process engineering applications since pumps, compressors, and wind have an impact on nearly every plant. In technical literature, these conditions are called a "high stress environment."
Theoretical Values for the Expected Fault Frequencies
The use of four-wire resistance thermometers may reduce the frequency of dangerous undetectable faults.
Actual Determined Failure Probability
How can failure probability be determined? A large manufacturer analyzed production output over several years. Within this time, tens of thousands of sensors with three-wire Pt100s were sold. Only a few devices were sent back to the manufacturer with the fault “measuring deviation.” This shows for real applications a ?dum, which is significantly better than the expected theoretical value.
? du = 60 FIT (WIKAKli, Pt100/3L)
Determination of the SIL Classification of a Thermometer with Transmitter
To determine the SIL classification of a thermometer and transmitter, the fault probability and the percentage of safe faults are calculated. The sum of the fault probability of a transmitter and sensor are specified in the formula indicated in the standard.
Recommendation
The instrumentation of temperature measuring points in safety-critical applications up to 600°C/1112°F should be carried out using four-wire Pt100 sensors and modern SIL-certified temperature transmitters. To detect the sensor drift, the thermometer should be mounted in a thermowell so that it can be properly calibrated at regular intervals.
Sources
- EN 61508-4:2001
- FIT = Failure in Time, l = 10-9 h-1
- EXIDA Safety Equipment Reliability Handbook 2003
- For a calibration interval of 2 years, the following SIL classifications can be obtained: PFD = Probability of Failure on Demand and SFF = Safe Failure Fraction
- Safety handbook WIKA T32.1S, 2010
- http://www.isa.org
Resources
- Dr. A. Hildebrand - Documentation for SIL training, TÜV-Süd academy, 2008
- EXIDA report: WIKA T32.10: 02/3-10 R002