SAFETY MANUAL - Tuv-fs.com

SAFETY MANUAL
When isolation barriers are used in safety critical applications,
line-monitoring thresholds shall be configured to detect barrier faults. This
ensures that barrier faults do not inhibit the safety critical function.
3.2.5 EN 60204 Category 0 & 1 Configurations
The system is fully compliant for use with category 0 application (de-energise to
trip).
Category 1 configurations require a controlled stop with power available to the
machine actuators to achieve the stop and then removal of power.
The 8000 system has a defined internal fail-safe state as de-energised. This could
result in the defined shutdown delay being shortened in some cases of I/O failure,
CPU failure or loss of power to the system.
3.2.6 NFPA 85 Requirements
The 8000 system is certified to be used in NFPA 85 compliant systems.
The systems should be integrated in accordance with NFPA 85. In particular the
following shall be applied.
• The operator shall be provided with a dedicated manual switch that shall
independently and directly actuate the safety shutdown trip relay. At least one
identified manual switch shall be located remotely from the boiler where it can
be reached in case of emergency.
• The burner management system shall be provided with independent logic,
independent input/output systems, and independent power supplies and shall
be a functionally and physically separate device from other logic systems, such
as the boiler or HRSG control system.
• Momentary Closing of Fuel Values. Logic sequences or devices intended to
cause a safety shutdown, once initiated, shall cause a burner or master fuel
trip, as applicable, and shall require operator action prior to resuming operation
of the affected burner(s). No logic sequence or device shall be permitted that
allows momentary closing and subsequent inadvertent reopening of the main or
ignition fuel valves.
• Documentation shall be provided to the owner and operator, indicating that all
safety devices and logic meet the requirements of the application.
• System response time (i.e. throughput) shall be sufficiently short to prevent
negative effects on the application.
Doc Number P8094
Issue 14 September 2003 Page 45 of 67